A hospital shared internet of things equipment use record encrypted storage tracing system

Abstract

The application discloses a hospital shared Internet of Things equipment use record encryption storage tracing system, relates to the technical field of medical Internet of Things data security storage and tracing, and is characterized in that the system is provided with an Internet of Things equipment access layer for collecting shared equipment use original records, a data preprocessing and grading module for marking the records with a sensitive level and then routing the records to a corresponding encryption channel, a multi-level encryption storage module for respectively adopting lightweight symmetric encryption and full homomorphic encryption storage according to the sensitive level, a double-chain tracing account book module for respectively storing the use records and access audit information through a storage chain and an audit chain, a fine-grained access control module for issuing time-limited decryption tokens based on an attribute policy, and an abnormal behavior detection and early warning module for monitoring access behaviors and triggering graded early warnings. The application is adapted to the use scene of shared medical equipment in hospitals, takes into account data security protection and system operation efficiency, reduces the risk of sensitive data leakage, improves the tracing and checking efficiency, and reduces the false positives and false negatives of access abnormalities.

Description

Technical Field

[0001] This invention relates to the field of medical Internet of Things (IoT) data security storage and traceability technology, and in particular to a hospital shared IoT device usage record encryption storage and traceability system. Background Technology

[0002] To improve the utilization rate of medical equipment and reduce the cost of duplicate procurement, hospitals at all levels are now adopting a multi-department sharing scheduling model for a large number of medical examination, treatment, and rehabilitation equipment. The usage records generated by these shared devices, including startup and shutdown times, operator identification information, equipment operating parameters, and associated patient medical records, are core evidence for medical liability determination, equipment maintenance audits, and regulatory compliance verification. Their security and traceability directly relate to the legitimate rights and interests of both doctors and patients, and also directly affect the hospital's level of compliant operation. With the advancement of hospital IoT construction, the collection of shared device usage records is gradually becoming automated. However, the corresponding storage and traceability systems still have many shortcomings. Traditional centralized storage models store all usage records uniformly on the central server of the hospital information system, often using common encryption methods or even plaintext storage. Access control is lax; once the server is attacked or internal personnel access it without authorization, it is extremely easy to cause the leakage of patient privacy and sensitive medical operation data. Furthermore, data stored in a centralized manner is easily tampered with, making it difficult to guarantee the credibility of records in the event of medical disputes.

[0003] Most existing storage solutions for medical device usage records are not adapted to the sensitive data characteristics of medical scenarios. They fail to classify the sensitivity of different fields in the usage records, either using uniform high-strength encryption for all records, which increases system computing power consumption and affects the real-time upload and storage efficiency of device usage records, or using uniform low-strength encryption, which cannot meet the security protection requirements of highly sensitive data such as patient diagnosis and treatment information. In terms of traceability system construction, existing solutions mostly use a single blockchain to store all data, mixing usage records and audit records on the chain. This not only consumes a lot of on-chain storage resources, but also fails to achieve two-way correlation and traceability between usage records and access audit records. Compliance reviews require manual comparison of multiple types of data, resulting in low verification efficiency.

[0004] Furthermore, existing access control solutions often employ fixed role-based permission divisions, which are ill-suited to the complex access scenarios involving multiple departments, roles, and device types within hospitals. This can easily lead to issues like excessive delegation of permissions or insufficient permissions, and the lack of time limits on access credentials means that leaked credentials pose a continuous data security risk. Anomaly detection for access behavior often relies on fixed thresholds, which cannot adapt to the varying access frequencies of different departments and devices, easily resulting in false positives or false negatives and making it difficult to detect unauthorized access in a timely manner. Currently, there is no unified identifier binding for shared device usage sessions, requiring the sifting of large amounts of irrelevant data when tracing device usage records for a specific time period, resulting in low tracing efficiency and failing to meet the practical needs of rapid liability determination in medical disputes and rapid verification of regulatory compliance. Summary of the Invention

[0005] This invention proposes a hospital shared IoT device usage record encryption storage and traceability system to solve the problems mentioned in the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a hospital shared IoT device usage record encryption storage and traceability system, comprising: The IoT device access layer is deployed in the shared medical equipment terminals of various departments. It integrates device identification chips and usage status sensors to collect the power-on time, power-off time, operator identification, department affiliation code and device operating parameters of the shared devices in real time, and generate raw usage record data packets. The data preprocessing and classification module receives raw usage record data packets uploaded by the IoT device access layer, marks the usage records with sensitivity levels according to preset sensitive field classification rules, and routes the marked and classified usage records to the corresponding encryption channels with corresponding encryption strengths. A multi-level encrypted storage module includes a lightweight symmetric encryption submodule and a fully homomorphic encryption submodule. The lightweight symmetric encryption submodule performs real-time encrypted storage of low-sensitivity usage records, while the fully homomorphic encryption submodule performs ciphertext encrypted storage of high-sensitivity usage records and supports ciphertext retrieval. The dual-chain traceability ledger module includes a storage chain and an audit chain. The storage chain records the hash value and timestamp of encrypted device usage records in the form of blocks, forming a device usage trajectory. The audit chain records the visitor's identity, access time, and access purpose for each data access operation in independent blocks, forming an audit log chain. The fine-grained access control module constructs access control policy trees for different departmental roles and different equipment types based on attribute-based encryption strategies. When a data requester initiates a traceability query, it matches and verifies the requester's attribute set with the access control policy tree and issues a time-restricted decryption token. The abnormal behavior detection and early warning module continuously monitors the access behavior patterns of the dual-chain traceability ledger module, calculates the deviation degree of access behavior based on historical baseline data, and triggers a graded early warning when the deviation degree exceeds the adaptive threshold, and pushes an abnormal alarm notification to the hospital information security center.

[0007] Furthermore, it also includes an adaptive encryption strength adjustment module, which works in conjunction with the data preprocessing and grading module and the multi-level encrypted storage module to dynamically adjust the key length of the encryption algorithm based on the real-time system load and the sensitivity level of the records. The determination of the key length follows the following adaptive adjustment strategy: ; In the formula The length of the encryption key corresponding to the currently used record. Based on the base key length, Rate the dimensionless sensitivity level of the current usage record. This is the threshold for the dimensionless baseline sensitivity level.

[0008] Furthermore, it also includes a device sharing session management module. This module generates a globally unique session identifier for each shared device usage session and binds the session identifier with the operator's identity identifier, departmental affiliation code, and device identity identifier to form a five-tuple session credential. After the shared session ends, the device sharing session management module adds a session termination timestamp to all usage record data packets generated in this session and submits the five-tuple session credential to the dual-chain traceability ledger module for on-chain storage.

[0009] Furthermore, the sensitive field classification rules of the data preprocessing and grading module adopt a two-dimensional sensitivity quantification model based on field information entropy and access frequency. A sensitivity score is calculated for each field in the original usage record. The sensitivity score calculation method after standardization of dimensions is as follows: ; In the formula, For fields The dimensionless sensitivity score, For fields Normalized information entropy, For fields The information entropy value is calculated from the uniformity of the distribution of the field's value range. For fields The maximum possible information entropy For fields The number of times the device was accessed within a preset statistical period. This sets the maximum number of times all fields can be accessed within a preset statistical period. For information entropy weighting coefficients, This is the access frequency weighting coefficient.

[0010] Furthermore, the storage chain and audit chain of the dual-chain traceability ledger module adopt an asynchronous block generation mechanism. The block generation cycle of the storage chain is dynamically adjusted by the generation rate of device usage records, and the minimum generation interval is no greater than the preset storage delay limit. The block of the audit chain is generated immediately after each data access operation, and in addition to recording the visitor's identity, access time and access purpose, the block body also embeds the hash pointer of the accessed storage chain block to form a cross-chain association index between the storage chain and the audit chain.

[0011] Furthermore, the deviation of access behavior in the abnormal behavior detection and early warning module is calculated using a statistical anomaly detection method based on a sliding time window, and the deviation is calculated according to the following formula: ; In the formula The dimensionless deviation of the current access behavior. This is a count of the number of visits within the current sliding time window. This represents the average frequency of visits within the historical sliding time window. The standard deviation of the access frequency within the historical sliding time window. As a smoothing constant, when Exceeding the preset deviation threshold When this happens, the abnormal behavior detection and early warning module will mark the current access behavior as abnormal and trigger a tiered early warning.

[0012] Furthermore, in the attribute-based encryption strategy of the fine-grained access control module, the access control policy tree is a binary tree structure. The leaf nodes of the binary tree correspond to single attribute conditions, including department type, professional title level, and equipment category. The intermediate nodes of the binary tree are AND gate or OR gate threshold operators. When the data requester submits a traceability query request, the fine-grained access control module extracts the requester's attribute set and recursively matches it with the access control policy tree from the root node to the leaf node. If the match is successful, a time-limited decryption token bound to the requester's attribute set is generated and a valid time window for the token is set. The token automatically expires after the valid time window expires. Each token issuance and expiration event is written into the audit chain as an audit record.

[0013] Furthermore, a method for encrypting, storing, and tracing the usage records of shared IoT devices in hospitals includes the following steps: Step 1: Device registration and identity binding. The shared IoT devices in various departments of the hospital are registered in the system through the device identification chip and bound to the department code and device type label. The device digital identity certificate is generated and written to the device's security chip. Step 2: Real-time data collection of usage records. When the operator starts the shared device, the device sharing session management module generates a globally unique session identifier and creates a five-tuple session credential. The IoT device access layer collects the power-on time, operator identification, department affiliation code, and device operating parameters in real time and encapsulates them into the original usage record data packet. Step 3: Record grading and encrypted storage. After receiving the original usage record data packet, the data preprocessing and grading module calculates the sensitivity score of each field and divides the usage records into high sensitivity level and low sensitivity level. Low sensitivity level usage records are stored in the storage chain after being lightly symmetric encrypted, and high sensitivity level usage records are stored in the storage chain after being fully homomorphically encrypted. Each encrypted storage operation synchronously generates a storage operation audit record in the audit chain. Step 4: Dual-chain evidence storage and associated index. The storage chain packages the hash value and timestamp of the encrypted usage record into a block and puts it on the chain at a fixed or adaptive block generation cycle. The audit chain generates an audit block containing a cross-chain hash pointer immediately after each data access or storage operation, forming an association between the storage chain and the audit chain. Step 5: Fine-grained access control and traceability query. When a traceability query request arrives, the fine-grained access control module performs policy matching verification on the requester's attributes through the attribute-based encryption policy. After successful verification, a time-limited decryption token is issued, and the target usage record in the storage chain is decrypted within the token's validity period. At the same time, the audit chain records the audit information of this traceability query operation. Step Six: Real-time Detection of Abnormal Behavior. The abnormal behavior detection and early warning module continuously monitors the access behavior patterns of shared devices in each department and calculates the deviation degree of access behavior. When the deviation degree exceeds the adaptive threshold, a graded early warning is triggered, and an abnormal alarm notification is pushed to the relevant department administrators through the hospital information security center.

[0014] Furthermore, in step three, when the fully homomorphic encryption submodule performs ciphertext retrieval operations on highly sensitive records in ciphertext state, it uses the following ciphertext similarity matching algorithm to calculate the matching degree between the search keywords and the ciphertext records: ; In the formula To retrieve the similarity between keywords and encrypted records, To search for keyword number Encryption encoding of 3D feature vectors in ciphertext space For the encrypted record Encryption encoding of 3D feature vectors in ciphertext space Represents the homomorphic inner product operation in the ciphertext space; This represents the total number of dimensions of the feature vectors.

[0015] Furthermore, in step six, the adaptive threshold update strategy is for the abnormal behavior detection and early warning module to update the threshold at the end of each sliding time window based on the most recent... The distribution characteristics of access behavior deviation within a sliding time window are used to recalculate the deviation threshold for the next sliding time window. When the kurtosis coefficient of the deviation exceeds the preset upper limit of kurtosis within a sliding time window, the adaptive threshold shrinks towards the mean. When the skewness coefficient of the deviation exceeds the preset skewness upper limit within a sliding time window, the adaptive threshold expands towards the direction of data sparsity. This is the count value for the sliding time window.

[0016] Compared with existing technologies, the beneficial effects of this invention are: This invention addresses the unique characteristics of shared IoT devices in hospitals, constructing a comprehensive security traceability system encompassing data collection, hierarchical encryption, dual-chain evidence storage, access control, and anomaly detection. This system is tailored to the sensitive data protection needs of medical settings. By classifying the sensitivity of usage record fields and matching storage methods with varying encryption strengths, the system meets the security requirements for highly sensitive data while reducing overall system computational consumption and improving real-time storage efficiency of usage records. A dual-chain architecture separating the storage chain and the audit chain is employed. The storage chain stores encrypted device usage records, while the audit chain stores audit logs for all accesses and operations. These two chains are linked by hash pointers, ensuring both usage and audit records are immutable and enabling bidirectional traceability. During compliance reviews or dispute tracing, all operation information corresponding to the target record can be quickly located, improving the efficiency of traceability and verification.

[0017] This invention employs an attribute-based fine-grained access control strategy, combining attributes such as hospital department roles and equipment types to construct the access control policy. This approach adapts to complex hospital access scenarios, avoiding issues of excessive delegation or insufficient permissions. It also issues time-limited decryption tokens that automatically expire, reducing the risk of data leakage even in the event of token leakage. The detection of access behavior uses adaptively adjusting thresholds, adapting to differences in access patterns across different departments and devices, reducing false positives and false negatives, and promptly detecting abnormal access behavior.

[0018] For highly sensitive usage records, fully homomorphic encryption is used for storage, enabling encrypted retrieval without decryption and avoiding the risk of sensitive data leakage during the retrieval process. A unique session identifier is generated for each device usage session, binding it to the corresponding operator, device, and department information. During tracing, the full usage record of the corresponding session can be retrieved directly through the session identifier, improving the convenience of tracing. The encryption strength can be dynamically adjusted according to system load and record sensitivity level, ensuring normal storage of usage records even under high system load, balancing system operating efficiency and data security protection capabilities. Attached Figure Description

[0019] Figure 1 This is an overall flowchart of the hospital shared IoT device usage record encryption storage and traceability system proposed in this invention; Figure 2 This is a flowchart illustrating the hierarchical and multi-level encrypted storage process of the data preprocessing of this invention. Figure 3 This is a flowchart of the device sharing session management and dual-chain association evidence storage process of the present invention; Figure 4 This is a flowchart of the fine-grained access control and abnormal behavior monitoring and early warning process of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0022] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified. Furthermore, the terms "installed," "connected," and "linked" should be interpreted broadly; for example, they may refer to a fixed connection, a detachable connection, or an integral connection; they may refer to a mechanical connection or an electrical connection; they may refer to a direct connection or an indirect connection through an intermediate medium; and they may refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances. The invention will now be described in further detail with reference to the accompanying drawings.

[0023] Reference Figures 1 to 4 A hospital shared IoT device usage record encryption storage and traceability system, comprising: The IoT device access layer is deployed in the shared medical equipment terminals of various departments and integrates device identification chips and usage status sensors to collect the power-on time, power-off time, operator identification, department affiliation code and equipment operating parameters of the shared devices in real time and generate original usage record data packets. The data preprocessing and classification module receives the raw usage record data packets uploaded by the IoT device access layer and marks the usage records with sensitivity levels according to the preset sensitive field classification rules. The marked and classified usage records are then routed to the encryption channels with corresponding encryption strengths. The multi-level encrypted storage module includes a lightweight symmetric encryption submodule and a fully homomorphic encryption submodule. The lightweight symmetric encryption submodule performs real-time encrypted storage of low-sensitivity usage records, while the fully homomorphic encryption submodule performs encrypted storage of high-sensitivity usage records in ciphertext and supports ciphertext retrieval. The dual-chain traceability ledger module includes a storage chain and an audit chain. The storage chain records encrypted device usage records hash values ​​and timestamps in the form of blocks to form an immutable usage trajectory. The audit chain records the visitor's identity, access time, and access purpose for each data access operation in independent blocks to form a complete audit log chain. The fine-grained access control module constructs access control policy trees for different department roles and different equipment types based on attribute-based encryption strategies. When a data requester initiates a traceability query, the module matches and verifies the requester's attribute set with the access control policy tree before issuing a restricted decryption token. The abnormal behavior detection and early warning module continuously monitors access behavior patterns in the dual-chain traceability ledger module and calculates the deviation degree of access behavior based on historical baseline data. When the deviation degree exceeds the adaptive threshold, it triggers a graded early warning and pushes an abnormal alarm notification to the hospital information security center.

[0024] This invention also includes an adaptive encryption strength adjustment module, which works in conjunction with the data preprocessing and grading module and the multi-level encryption storage module to dynamically adjust the key length of the encryption algorithm based on the real-time system load and the sensitivity level of the records. The determination of the key length follows the following adaptive adjustment strategy: ; In the formula The length of the encryption key corresponding to the currently used record, in bits; This is the base key length, measured in bits. The dimensionless sensitivity level score for the current usage record is output by the data preprocessing and classification module. The dimensionless baseline sensitivity threshold, and Dimensions are consistent.

[0025] This invention also includes a device sharing session management module. This module generates a globally unique session identifier for each shared device usage session and binds the session identifier with the operator's identity identifier, departmental affiliation code, and device identity identifier to form a five-tuple session credential. After the shared session ends, the device sharing session management module adds a session termination timestamp to all usage record data packets generated in this session and submits the five-tuple session credential to the dual-chain traceability ledger module for on-chain storage. When a medical dispute occurs and it is necessary to trace the historical usage trajectory of a certain device, the session identifier can be used to retrieve all usage records and operator information of the device within a specified time period with one click.

[0026] In this invention, the sensitive field classification rules of the data preprocessing and classification module adopt a two-dimensional sensitivity quantification model based on field information entropy and access frequency. A sensitivity score is calculated for each field in the original usage record. The sensitivity score calculation method after standardization of dimensions is as follows: ; In the formula, For fields The dimensionless sensitivity score, with a value range of ; For fields Normalized information entropy, For fields The information entropy value is calculated from the uniformity of the distribution of the field's value range. For fields The maximum possible information entropy The range of values ​​is ; For fields The number of times the device was accessed within a preset statistical period. This sets the maximum number of times all fields are accessed within a preset statistical period. For information entropy weighting coefficients, The access frequency weighting coefficient and satisfying ;when When the threshold is exceeded, the field is marked as highly sensitive and routed to the fully homomorphic encryption submodule. When the sensitivity level is between the second preset threshold and the first preset threshold, the field is marked as medium sensitivity. When the sensitivity level is below the second preset threshold, the field is marked as low sensitivity and routed to the lightweight symmetric encryption submodule.

[0027] In this invention, the storage chain and audit chain of the dual-chain traceability ledger module adopt an asynchronous block generation mechanism. The block generation cycle of the storage chain is dynamically adjusted by the generation rate of device usage records, and the minimum generation interval is no greater than the preset storage latency limit. The blocks of the audit chain are generated immediately after each data access operation, and in addition to recording the visitor's identity, access time, and access purpose, the block body also embeds the hash pointer of the accessed storage chain block to form a cross-chain association index between the storage chain and the audit chain. When an external regulatory agency requires a compliance review of the access history of a certain usage record, the cross-chain association index of the audit chain is used to reverse locate the target usage record block in the storage chain and trace back the entire access operation sequence of the usage record since its creation block by block.

[0028] In this invention, the deviation of access behavior in the abnormal behavior detection and early warning module is calculated using a statistical anomaly detection method based on a sliding time window. The deviation is calculated according to the following formula: ; In the formula The dimensionless deviation of the current access behavior; This is a count of the number of accesses within the current sliding time window, in times per window. This represents the average frequency of accesses within a historical sliding time window, expressed as times per window. This represents the standard deviation of access frequency within the historical sliding time window, expressed as times per window. It is a smoothing constant, taking a positive decimal value to avoid the denominator being zero, and its dimensions are the same as... Unified as secondary / window; when Exceeding the preset deviation threshold The abnormal behavior detection and early warning module marks the current access behavior as abnormal and triggers a tiered early warning.

[0029] In this invention, the access control policy tree in the attribute-based encryption strategy of the fine-grained access control module is a binary tree structure. The leaf nodes of the binary tree correspond to single attribute conditions, including department type, professional title level, and equipment category. The intermediate nodes of the binary tree are AND gate or OR gate threshold operators. When the data requester submits a traceability query request, the fine-grained access control module extracts the requester's attribute set and recursively matches it with the access control policy tree from the root node to the leaf node. If the match is successful, a time-limited decryption token bound to the requester's attribute set is generated and the valid time window of the token is set. The token automatically expires after the valid time window expires and needs to be reapplied for. Each token issuance and expiration event is written into the audit chain as an audit record.

[0030] This invention discloses a method for encrypting, storing, and tracing the usage records of shared IoT devices in hospitals, comprising the following steps: Step 1: Device registration and identity binding. The shared IoT devices in various departments of the hospital are registered in the system through the device identification chip and bound to the department affiliation code and device type label. The device digital identity certificate is generated and written to the device's security chip. Step 2 uses real-time data collection. When the operator starts the shared device, the device sharing session management module generates a globally unique session identifier and creates a five-tuple session credential. The IoT device access layer collects the power-on time, operator identity, department affiliation code and device operating parameters in real time and encapsulates them into the original usage record data packet. Step 3 records classification and encrypted storage. After receiving the original usage record data packet, the data preprocessing and classification module calculates the sensitivity score of each field and divides the usage records into high sensitivity level and low sensitivity level. Low sensitivity level usage records are stored in the storage chain after being lightly symmetric encrypted, and high sensitivity level usage records are stored in the storage chain after being fully homomorphically encrypted and retain the ciphertext retrieval capability. Each encrypted storage operation synchronously generates a corresponding storage operation audit record in the audit chain. Step 4: Dual-chain evidence storage and associated index. The storage chain packages the hash value and timestamp of the encrypted usage record into a block and puts it on the chain at a fixed or adaptive block generation cycle. The audit chain generates an audit block containing a cross-chain hash pointer immediately after each data access or storage operation, forming a two-way traceable association between the storage chain and the audit chain. Step 5: Fine-grained access control and traceability query. When a traceability query request arrives, the fine-grained access control module performs policy matching verification on the requester's attributes through the attribute-based encryption policy. After successful verification, a restriction decryption token is issued and the target usage record in the storage chain is decrypted within the token's validity time window. At the same time, the audit chain records the complete audit information of this traceability query operation. Step Six: Real-time Detection of Abnormal Behavior. The abnormal behavior detection and early warning module continuously monitors the access behavior patterns of shared devices in each department and calculates the deviation degree of access behavior. When the deviation degree exceeds the adaptive threshold, a graded early warning is triggered and an abnormal alarm notification is pushed to the relevant department administrators through the hospital information security center.

[0031] In this invention, in step three, the fully homomorphic encryption submodule performs a ciphertext retrieval operation on highly sensitive records in ciphertext state, employing the following ciphertext similarity matching algorithm to calculate the matching degree between the search keywords and the ciphertext records: ; In the formula To retrieve the similarity between keywords and encrypted records, a dimensionless value is used, with a range of [value missing]. ; To search for keyword number Encryption encoding of 3D feature vectors in ciphertext space For the encrypted record The encryption encoding of dimensional feature vectors in the ciphertext space, both belong to the same ciphertext space and have the same dimensions; Represents the homomorphic inner product operation in the ciphertext space; The total dimension of the feature vectors; the two square root terms in the denominator are the homomorphic moduli of the keyword ciphertext vector and the record ciphertext vector, respectively, which are dimensionally consistent with the result of the inner product operation in the numerator.

[0032] In this invention, the adaptive threshold update strategy in step six is ​​that the abnormal behavior detection and early warning module updates the threshold based on the most recent data at the end of each sliding time window. The distribution characteristics of access behavior deviation within a sliding time window are used to recalculate the deviation threshold for the next sliding time window. When the kurtosis coefficient of the deviation exceeds the preset kurtosis upper limit within a sliding time window, the adaptive threshold shrinks towards the mean to reduce false alarms. When the skewness coefficient of the deviation exceeds the preset skewness upper limit within a sliding time window, the adaptive threshold expands towards the direction of data sparsity to enhance the detection sensitivity of sudden abnormal access patterns. This is the count value for the sliding time window, and its value is a positive integer greater than or equal to ten.

[0033] The specific embodiments of the present invention are further illustrated below: This embodiment is applied to the scenario of secure storage and traceability of usage records of shared medical IoT devices in multiple departments of a hospital. The overall system deployment covers all shared medical device terminals, back-end server clusters, and consortium blockchain node clusters in the hospital. The collaborative operation of each module achieves full-link data security protection and traceable management.

[0034] First, device registration and identity binding are deployed. The IoT device access layer corresponds to the shared medical device terminals in each department. Each terminal integrates a dedicated secure identity chip and multiple usage status sensors. The secure identity chip contains a unique, tamper-proof hardware number for the device. The usage status sensors cover two types of data collection ports: device operation status acquisition and operator identity verification. Before going live, the device completes the registration process in the system, binding the device hardware number with the corresponding departmental code and device type label. The system generates a unique digital identity credential for the device and writes it to the secure identity chip on the device. The registration information is synchronized to the hospital's equipment management system to complete data alignment. The operator identity verification port using the status sensors connects to the hospital's existing staff identity verification terminals, directly obtaining the operator's identity verified by the hospital's identity system. The device operation status acquisition port connects to the device's main control unit, directly reading data such as the device's operating parameters and power-on / off status.

[0035] When an operator initiates a shared device usage request, identity verification is completed first. Upon successful verification, the device sharing session management module initiates the session creation process, generating a 128-bit globally unique session identifier. This session identifier is then bound to the operator's identity, departmental code, device identity, and session initiation time, forming a five-tuple session credential. This credential is stored simultaneously in the device's local cache and the backend session management cluster. During the session, the IoT device access layer collects the device's power-on time, power-off time, current operator's identity, departmental code, and device operating parameters in real-time at a preset collection frequency. Each collected data point is associated with the current session identifier and encapsulated into an original usage record data packet, which is then uploaded to the backend data preprocessing and hierarchical module via an encrypted transmission channel. At the end of the session, the device sharing session management module adds a session termination timestamp to all usage record data packets generated during the session and simultaneously submits the five-tuple session credential to the dual-chain traceability ledger module for on-chain storage.

[0036] After receiving the raw usage record data packet, the data preprocessing and classification module first performs data cleaning, removing invalid values, duplicate values, and formatted errors. Then, each usage record is broken down into independent field units, and a sensitivity score is assigned to each field based on preset sensitive field classification rules. The sensitivity scoring employs a two-dimensional sensitivity quantification model based on field information entropy and access frequency. First, the normalized information entropy of each field is calculated by statistically analyzing the frequency of all values ​​for that field within a preset 30-day statistical period. Then, the original information entropy of the field is obtained based on the Shannon entropy formula. Then calculate the maximum possible information entropy of the field. That is, the entropy value when all values ​​of the field are uniformly distributed. The normalized information entropy is obtained by dividing the original information entropy by the maximum possible information entropy. The normalized information entropy ranges from 0 to 1. Next, the normalized access frequency of this field is calculated, and the number of times this field is accessed within a 30-day statistical period is counted. At the same time, it retrieves the highest number of times each field has been accessed within the statistical period. ,calculate and The ratio is used to obtain the normalized access frequency, with a value ranging from 0 to 1. The information entropy weight coefficient is then set. The access frequency weighting coefficient is 0.6. The value is 0.4, and the sum of the two is 1. The product of the normalized information entropy and the corresponding weight is added to the product of the normalized access frequency and the corresponding weight to obtain the final sensitivity score of this field. The first preset threshold is set to 0.7, and the second preset threshold is set to 0.3. When the field sensitivity score exceeds 0.7, it is marked as high sensitivity; when the score is between 0.3 and 0.7, it is marked as medium sensitivity; and when the score is below 0.3, it is marked as low sensitivity. The sensitivity level of the same usage record is based on the highest sensitivity level of the fields contained in the record. After the marking is completed, usage records of different levels are routed to the encryption channels with corresponding encryption strengths.

[0037] The multi-level encrypted storage module and the encryption strength adaptive adjustment module work together to complete the encrypted storage operation. The encryption strength adaptive adjustment module first obtains the sensitivity level score of the current usage record. , The highest field sensitivity score in the current record is then used to determine the preset baseline sensitivity level threshold. Basic key length Set to 128 bits, calculate the encryption key length corresponding to the current record according to the adaptive adjustment strategy. The low-sensitivity and medium-sensitivity usage records are encrypted using a lightweight symmetric encryption submodule. The encryption algorithm used is the Chinese national standard SM4 algorithm, and the key length is calculated. After encryption, the data is stored in the background distributed storage cluster. High-sensitivity usage records are encrypted using a fully homomorphic encryption submodule, employing the BFV fully homomorphic encryption scheme, with the key length also adapted to the calculated value. The encrypted ciphertext retains its ciphertext retrieval capabilities. When performing a ciphertext retrieval operation, the search keywords are first converted into 128-dimensional feature vectors. Homomorphic encryption is then applied to these feature vectors to obtain the ciphertext features of the search keywords. Next, the ciphertext feature vectors of the highly sensitive records to be retrieved are called, and the matching similarity between the two is calculated using a homomorphic inner product operation in the ciphertext space. After the matching similarity calculation is completed, it is compared with a preset matching threshold. Ciphertext records exceeding the threshold are returned as retrieval results. The entire retrieval process does not require decryption of the ciphertext. After each encrypted storage operation is completed, a corresponding storage operation audit record is synchronously generated and submitted to the audit chain.

[0038] The dual-chain traceability ledger module adopts a consortium blockchain architecture, with the storage chain and audit chain being two independent consortium chains. Chain nodes are deployed in the hospital information center, equipment management department, and local medical regulatory department, respectively. The consensus mechanism uses a practical Byzantine fault-tolerant algorithm to ensure data consistency. The storage chain employs an adaptive block generation mechanism, dynamically adjusting the block generation cycle based on the rate at which equipment usage records are generated. The block generation interval is shortened when the record generation rate is high and extended when the rate is low, with a minimum generation interval not exceeding a preset storage latency limit of 10 seconds. Each storage chain block stores the hash value, associated session identifier, and timestamp of all encrypted usage records within the corresponding period. The block hash value is calculated from the block body content using the SHA-256 algorithm and is tamper-proof. The audit chain employs a real-time block generation mechanism, generating an audit block immediately after each data access operation, storage operation, token issuance, or expiration event. In addition to recording the visitor's identity, access time, and purpose, the block also embeds a hash pointer to the accessed storage chain block. This hash pointer is a unique hash value for the corresponding storage chain block, forming a cross-chain association index between the storage chain and the audit chain. When external regulatory agencies conduct compliance reviews, they can directly locate the target usage record block in the storage chain through the audit chain's cross-chain association index. Alternatively, they can reverse-engineer all associated audit blocks from the target block in the storage chain, tracing back the entire sequence of access operations since the usage record's creation.

[0039] The fine-grained access control module employs a ciphertext policy attribute-based encryption scheme to construct the access control system. Based on the hospital's department roles and equipment types, an access control policy tree is built. The policy tree is a binary tree structure, with leaf nodes corresponding to individual attribute conditions, including four categories: department type, professional title level, equipment category, and access purpose. The intermediate nodes of the binary tree represent three types of logical operators: AND gate, OR gate, and threshold operator. When a data requester initiates a traceability query request, it first submits its own attribute set and query application. The fine-grained access control module extracts the requester's attribute set and recursively matches it layer by layer from the root node to the leaf nodes of the access control policy tree. If the attribute set satisfies the logical judgment rules of the policy tree, a successful match is determined, and a time-limited decryption token bound to the requester's attribute set is generated. The token's validity period is set according to the access purpose, with a minimum validity period of 30 minutes and a maximum of 24 hours. The token automatically expires after the validity period window, and the requester needs to resubmit an application to obtain a new token. Each token issuance and expiration event is recorded in real-time and written to the audit chain as an audit record. After obtaining the decryption token, the requesting party can only decrypt ciphertext usage records that match its own attributes and cannot access other records beyond its permission scope.

[0040] The abnormal behavior detection and early warning module continuously monitors access behavior data in the dual-chain traceability ledger module. It uses a statistical anomaly detection method based on a sliding time window to calculate the deviation of access behavior. The sliding time window size is set to 1 hour, and the sliding step size is set to 10 minutes. It counts the access frequency within the current sliding time window. Then, analyze the access frequency data for all sliding time windows within the same period over the past 30 days, and calculate the average historical access frequency. with standard deviation Set the smoothing constant The value is 0.001. The deviation of the current access behavior is obtained according to the deviation calculation formula. The deviation threshold employs an adaptive update strategy. At the end of each sliding time window, the deviation threshold for the next sliding time window is recalculated based on the distribution characteristics of the deviation of access behavior within the most recent 10 sliding time windows. When the kurtosis coefficient of the deviation within the most recent 10 sliding time windows exceeds the preset kurtosis upper limit of 3, it indicates that the access behavior distribution is relatively concentrated, and the adaptive threshold shrinks towards the mean to reduce false alarms. When the skewness coefficient of the deviation within the most recent 10 sliding time windows exceeds the preset skewness upper limit of 1, it indicates that the access behavior exhibits a long-tail distribution, and the adaptive threshold expands towards data sparsity to enhance the detection sensitivity for sudden abnormal access patterns. When the deviation of the current access behavior exceeds the adaptive threshold, the abnormal behavior detection and early warning module marks the current access behavior as abnormal and triggers a tiered early warning based on the magnitude of the deviation. Low-level abnormalities push early warning notifications to the corresponding department administrators, while high-level abnormalities directly push abnormal alarm notifications to the hospital information security center.

[0041] When conducting traceability queries, if it is necessary to retrieve the usage records of a specific device for a specified period, the requesting party can submit a query application and, after passing attribute verification, directly input the target device identifier and time range. The system retrieves the encrypted records that meet the conditions from the storage chain, decrypts them with a decryption token, and returns the complete usage records. If a medical dispute requires tracing information related to a specific device usage instance, the corresponding session identifier can be directly input. The system can then use the session identifier to retrieve all usage records, operator information, and corresponding audit records associated with that session with a single click, without needing to filter out other irrelevant data. All operations in the entire traceability process are recorded in the audit chain, and the hash values ​​of all usage records are stored in an immutable storage chain, ensuring the authenticity and credibility of the traceability data.

[0042] Reference Figure 1 This flowchart illustrates the overall operational logic of the hospital's shared IoT device usage record encryption storage and traceability system. First, the system completes the registration of shared medical devices in each department and binds the terminal's digital identity. During device usage, the IoT device access layer collects operating parameters and personnel information in real time and generates raw usage record data packets. Subsequently, the data preprocessing module classifies the sensitivity based on field characteristics and assigns it to the corresponding encryption channel for adaptive encryption. The encrypted ciphertext data and access operation logs are asynchronously written to the dual-chain traceability ledger module to form an immutable evidence storage system. In the data retrieval and traceability stage, the fine-grained access control module performs attribute verification on the requester and issues a decryption token. Simultaneously, the background continuously performs real-time detection of abnormal behavior, triggering tiered alarms for unauthorized access patterns, achieving secure closed-loop management of the shared device data lifecycle.

[0043] Reference Figure 2 This flowchart illustrates the intelligent grading and multi-level encrypted storage mechanism for raw usage records. Upon receiving the uploaded raw usage record data packet, the preprocessing and grading modules extract the distribution parameters of each field and calculate an objective sensitivity score by combining information entropy and historical access frequency. Based on this score, the system performs path distribution: low-sensitivity data is guided to the lightweight symmetric encryption submodule for processing to ensure processing efficiency under large-scale concurrency; high-sensitivity data is routed to the fully homomorphic encryption submodule to maintain subsequent ciphertext retrieval capabilities. During the encryption phase, the adjustment module also comprehensively evaluates the current system load and data security level, dynamically scaling the key length of the encryption algorithm. The ciphertext data, after multi-level matching encryption, is finally written to the underlying storage network, achieving an optimal balance between computational resource consumption and data privacy protection.

[0044] Reference Figure 3This flowchart illustrates the full-lifecycle management of device sharing sessions and the cross-chain evidence storage logic of the dual-chain ledger structure. When an operator starts a shared device, the session management module generates a globally unique identifier, which is strongly bound to the operator's identity, department code, and device identifier to construct a five-tuple session credential. After the usage process ends, the system adds a termination timestamp to the data packet and initiates the on-chain operation. In the underlying ledger operation, the storage chain dynamically adjusts the block generation cycle according to the record generation rate, solidifying the encrypted records and timestamps; the audit chain immediately packages and generates blocks after each data access, embedding a cross-chain hash pointer pointing to the corresponding storage chain block in the block body. This asynchronously generated and mutually anchored dual-chain index architecture enables regulatory agencies to accurately locate storage chain records by reverse engineering based on audit chain clues, significantly improving the reliability of medical traceability.

[0045] Reference Figure 4 This flowchart describes the access control defenses and real-time monitoring process for unauthorized access to encrypted data. When a data requester initiates a traceability query, the fine-grained access control module extracts the requester's department and professional title attributes and recursively matches them layer by layer against a binary tree-based access control policy tree. Only compliant requests with perfectly matching attributes are granted a time-limited decryption token with a valid time window. Simultaneously with front-end access control, the abnormal behavior detection module introduces a sliding time window mechanism in the background, continuously recording access frequency and calculating its dynamic deviation from the historical baseline. The system also automatically updates the judgment threshold based on recent access characteristics. Once the deviation exceeds the set security boundary, the module immediately triggers a tiered early warning mechanism and pushes an alarm to the hospital's information security center, effectively cutting off potential risks of data misuse and abuse.

[0046] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A hospital shared IoT device usage record encryption storage and traceability system, characterized in that, include: The IoT device access layer is deployed in the shared medical equipment terminals of various departments. It integrates device identification chips and usage status sensors to collect the power-on time, power-off time, operator identification, department affiliation code and device operating parameters of the shared devices in real time, and generate raw usage record data packets. The data preprocessing and classification module receives raw usage record data packets uploaded by the IoT device access layer, marks the usage records with sensitivity levels according to preset sensitive field classification rules, and routes the marked and classified usage records to the corresponding encryption channels with corresponding encryption strengths. A multi-level encrypted storage module includes a lightweight symmetric encryption submodule and a fully homomorphic encryption submodule. The lightweight symmetric encryption submodule performs real-time encrypted storage of low-sensitivity usage records, while the fully homomorphic encryption submodule performs ciphertext encrypted storage of high-sensitivity usage records and supports ciphertext retrieval. The dual-chain traceability ledger module includes a storage chain and an audit chain. The storage chain records the hash value and timestamp of encrypted device usage records in the form of blocks, forming a device usage trajectory. The audit chain records the visitor's identity, access time, and access purpose for each data access operation in independent blocks, forming an audit log chain. The fine-grained access control module constructs access control policy trees for different departmental roles and different equipment types based on attribute-based encryption strategies. When a data requester initiates a traceability query, it matches and verifies the requester's attribute set with the access control policy tree and issues a time-restricted decryption token. The abnormal behavior detection and early warning module continuously monitors the access behavior patterns of the dual-chain traceability ledger module, calculates the deviation degree of access behavior based on historical baseline data, and triggers a graded early warning when the deviation degree exceeds the adaptive threshold, and pushes an abnormal alarm notification to the hospital information security center.

2. The hospital shared IoT device usage record encryption storage and traceability system according to claim 1, characterized in that, It also includes an adaptive encryption strength adjustment module, which works in conjunction with the data preprocessing and grading module and the multi-level encrypted storage module to dynamically adjust the key length of the encryption algorithm based on the real-time system load and the sensitivity level of the records. The determination of the key length follows the following adaptive adjustment strategy: ； In the formula The length of the encryption key corresponding to the currently used record. Based on the base key length, Rate the dimensionless sensitivity level of the current usage record. This is the threshold for the dimensionless baseline sensitivity level.

3. The hospital shared IoT device usage record encrypted storage and traceability system according to claim 1, characterized in that, It also includes a device sharing session management module. The device sharing session management module generates a globally unique session identifier for each shared device usage session and binds the session identifier with the operator's identity identifier, department affiliation code and device identity identifier to form a five-tuple session certificate. After the shared session ends, the device sharing session management module adds a session termination timestamp to all usage record data packets generated in this session and submits the five-tuple session certificate to the dual-chain traceability ledger module for on-chain storage.

4. A hospital shared IoT device usage record encryption storage and traceability system according to claim 1, characterized in that, The sensitive field classification rules of the data preprocessing and classification module adopt a two-dimensional sensitivity quantification model based on field information entropy and access frequency. A sensitivity score is calculated for each field in the original usage record. The sensitivity score calculation method after standardization of dimensions is as follows: ； In the formula, For fields The dimensionless sensitivity score, For fields Normalized information entropy, For fields The information entropy value is calculated from the uniformity of the distribution of the field's value range. For fields The maximum possible information entropy For fields The number of times the device was accessed within a preset statistical period. This sets the maximum number of times all fields can be accessed within a preset statistical period. For information entropy weighting coefficients, This is the access frequency weighting coefficient.

5. A hospital shared IoT device usage record encryption storage and traceability system according to claim 1, characterized in that, The storage chain and audit chain of the dual-chain traceability ledger module adopt an asynchronous block generation mechanism. The block generation cycle of the storage chain is dynamically adjusted by the generation rate of device usage records, and the minimum generation interval is no greater than the preset storage latency limit. The block of the audit chain is generated immediately after each data access operation, and in addition to recording the visitor's identity, access time and access purpose, the block body also embeds the hash pointer of the accessed storage chain block to form a cross-chain association index between the storage chain and the audit chain.

6. A hospital shared IoT device usage record encryption storage and traceability system according to claim 1, characterized in that, The deviation of access behavior in the abnormal behavior detection and early warning module is calculated using a statistical anomaly detection method based on a sliding time window. The deviation is calculated according to the following formula: ； In the formula The dimensionless deviation of the current access behavior. This is a count of the number of visits within the current sliding time window. This represents the average frequency of visits within the historical sliding time window. The standard deviation of the access frequency within the historical sliding time window. As a smoothing constant, when Exceeding the preset deviation threshold When this happens, the abnormal behavior detection and early warning module will mark the current access behavior as abnormal and trigger a tiered early warning.

7. A hospital shared IoT device usage record encrypted storage and traceability system according to claim 1, characterized in that, The fine-grained access control module uses a binary tree structure for its attribute-based encryption strategy. The leaf nodes of the binary tree correspond to individual attribute conditions, including department type, professional title level, and equipment category. The intermediate nodes of the binary tree are AND gate or OR gate threshold operators. When a data requester submits a traceability query request, the fine-grained access control module extracts the requester's attribute set and recursively matches it with the access control strategy tree from the root node to the leaf node. If the match is successful, a time-limited decryption token bound to the requester's attribute set is generated, and a valid time window for the token is set. The token automatically expires after the valid time window expires. Each token issuance and expiration event is written as an audit record into the audit chain.

8. A method for encrypting, storing, and tracing the usage records of shared IoT devices in hospitals, applied to the encrypted storage and tracing system for the usage records of shared IoT devices in hospitals as described in any one of claims 1 to 7, characterized in that, Includes the following steps: Step 1: Device registration and identity binding. The shared IoT devices in various departments of the hospital are registered in the system through the device identification chip and bound to the department code and device type label. The device digital identity certificate is generated and written to the device's security chip. Step 2: Real-time data collection of usage records. When the operator starts the shared device, the device sharing session management module generates a globally unique session identifier and creates a five-tuple session credential. The IoT device access layer collects the power-on time, operator identification, department affiliation code, and device operating parameters in real time and encapsulates them into the original usage record data packet. Step 3: Record grading and encrypted storage. After receiving the original usage record data packet, the data preprocessing and grading module calculates the sensitivity score of each field and divides the usage records into high sensitivity level and low sensitivity level. Low sensitivity level usage records are stored in the storage chain after being lightly symmetric encrypted, and high sensitivity level usage records are stored in the storage chain after being fully homomorphically encrypted. Each encrypted storage operation synchronously generates a storage operation audit record in the audit chain. Step 4: Dual-chain evidence storage and associated index. The storage chain packages the hash value and timestamp of the encrypted usage record into a block and puts it on the chain at a fixed or adaptive block generation cycle. The audit chain generates an audit block containing a cross-chain hash pointer immediately after each data access or storage operation, forming an association between the storage chain and the audit chain. Step 5: Fine-grained access control and traceability query. When a traceability query request arrives, the fine-grained access control module performs policy matching verification on the requester's attributes through the attribute-based encryption policy. After successful verification, a time-limited decryption token is issued, and the target usage record in the storage chain is decrypted within the token's validity period. At the same time, the audit chain records the audit information of this traceability query operation. Step Six: Real-time Detection of Abnormal Behavior. The abnormal behavior detection and early warning module continuously monitors the access behavior patterns of shared devices in each department and calculates the deviation degree of access behavior. When the deviation degree exceeds the adaptive threshold, a graded early warning is triggered, and an abnormal alarm notification is pushed to the relevant department administrators through the hospital information security center.

9. A method for encrypted storage and traceability of usage records of shared IoT devices in hospitals according to claim 8, characterized in that, In step three, the fully homomorphic encryption submodule uses the following ciphertext similarity matching algorithm to calculate the matching degree between the search keywords and the ciphertext records when performing ciphertext retrieval operations on highly sensitive records in ciphertext state: ； In the formula To retrieve the similarity between keywords and encrypted records, To search for keyword number Encryption encoding of 3D feature vectors in ciphertext space For the encrypted record Encryption encoding of 3D feature vectors in ciphertext space Represents the homomorphic inner product operation in the ciphertext space; This represents the total number of dimensions of the feature vectors.

10. A method for encrypted storage and traceability of usage records of shared IoT devices in hospitals according to claim 8, characterized in that, In step six, the adaptive threshold update strategy is for the abnormal behavior detection and early warning module to update the threshold at the end of each sliding time window based on the most recent... The distribution characteristics of access behavior deviation within a sliding time window are used to recalculate the deviation threshold for the next sliding time window. When the kurtosis coefficient of the deviation exceeds the preset upper limit of kurtosis within a sliding time window, the adaptive threshold shrinks towards the mean. When the skewness coefficient of the deviation exceeds the preset skewness upper limit within a sliding time window, the adaptive threshold expands towards the direction of data sparsity. This is the count value for the sliding time window.

Images