Method, computing unit and computer program for the encrypted storage and event-driven decryption of recorded data

Abstract

The invention relates to a method for the encrypted storage and event-driven decryption of recorded data, as well as a computing unit and a computer program for carrying it out. In this method, a plurality of data records (120) are recorded by means of a data acquisition unit (11) wearable on the body of a person (10), and the plurality of data records (120) are stored in encrypted form outside the data acquisition unit (11), wherein a separate key (16) is generated for each data record (120), which is divided into at least two key parts (16a - 16c) by means of a first multi-party computation protocol, which are stored in different locations.If a health impairment of the person (10) is detected by the data acquisition unit (11), a predetermined number of stored data records (120a) are decrypted using a second multi-party computation protocol, whereby the key (16) for each data record (120a) to be decrypted is reconstructed from the at least two key parts (16a - 16c).

Description

[0001] The present invention relates to a method for the encrypted storage and event-driven decryption of recorded data, as well as a computing unit and a computer program for carrying it out. Background of the invention

[0002] Personal health data relating to an individual's physical or mental health, and containing information about their health status, is subject to special legal protection. Therefore, when storing health data, including data generated by wearable devices, enhanced data security must be guaranteed. One way to provide such security, even in a public data cloud, is through multi-party analysis, where datasets are divided into individual parts in such a way that no conclusions can be drawn about the original data. Distributing the data parts across multiple parties ensures a high level of security, even in the case of some corrupt parties.

[0003] EP 4 044 496 A1 discloses a computer-implemented method for providing a distributed data processing service for performing a secure multi-party computation of a function on at least first and second elements of private input data using at least one first and one second computing unit coupled via a communication network. Disclosure of the invention

[0004] According to the invention, a method for the encrypted storage and event-driven decryption of recorded data, as well as a computing unit and a computer program for its implementation, are proposed, comprising the features of the independent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0005] The invention enables the secure storage of data, particularly sensitive health data, in an insecure environment, with the option to decrypt the data in specific emergency situations. The data encryption is implemented in such a way that the data can be decrypted in an emergency without requiring any action from the affected person. This allows, for example, doctors or paramedics to obtain important information about the affected person's health status, even if the person is unresponsive.

[0006] In the inventive method, a multitude of data sets are recorded using a wearable data acquisition unit. The latter can be, in particular, a so-called "wearable" device, such as a smartwatch, a fitness tracker, a smartphone with a fitness app, or even a computer system integrated into clothing or jewelry.

[0007] In particular, the data acquisition unit can determine and monitor bodily functions such as movement, heart rate, blood pressure, blood sugar levels, body temperature, and / or calorie consumption. For this purpose, it can include, for example, sensors for measuring pulse, heart rate, blood pressure, skin conductance, as well as accelerometers and sensors for location tracking.

[0008] By recording one or more of the aforementioned bodily functions using the data acquisition unit, data, which can also be referred to as a person's health data, can be generated, providing information about their state of health. A "data set" is understood to be a set of data recorded over a predetermined period, for example, a recording of a person's heart rate in relation to their speed during a half-hour run. It is also possible to continuously measure one or more bodily functions and store them, at least temporarily, as a data set on the data acquisition unit at predetermined intervals.

[0009] The resulting large number of recorded data records are then stored in encrypted form outside the data acquisition unit. Specifically, the large number of data records can be stored on an external server, particularly a cloud server. The data acquisition unit can be connected to the external server via a network connection, such as the internet and / or a mobile network, and the transmission of the data records can be carried out, for example, using end-to-end encryption.

[0010] To prevent unauthorized access to the stored data, a separate key is generated for each data record, which is then split into at least two key parts using an initial multi-party calculation protocol and stored in different locations.

[0011] According to one embodiment, one of the at least two key components can be stored in the data acquisition unit, and all other key components can be stored on distributed servers. Alternatively, all key components can be stored on distributed servers. These servers can be distributed across different parties and, in particular, configured to participate in a multi-party computing protocol. The different parties can be, for example, data storage services provided by private operators, government agencies, insurance companies, medical practices, and / or hospitals. The distributed servers in this way can also be, for example, cloud servers that are connected to the server on which the data records are stored via a network, such as the internet. Other server types are also possible, and the servers can be implemented as hardware or software servers.

[0012] In particular, the distributed servers can include so-called “virtual cloud providers” (VCPs) as described in EP 4 044 496 A1, the disclosure of which is to be included in the present patent application.

[0013] The key can be generated, for example, using a symmetric or asymmetric encryption method on the external server or, in particular, on the data acquisition unit. If the key is generated on the external server, it must be deleted after splitting and distribution and must not remain there. In the case of a symmetric encryption method, such as the Advanced Encryption Standard (AES), the same key is used for encryption and decryption; therefore, the data set is first encrypted, and then the key is split into at least two key parts. If a symmetric key is generated on the external server, it is deleted after splitting and distribution. If an asymmetric encryption method, e.g.,When RSA (Rivest-Shamir-Adleman) is used, a public key is generated for encrypting the data and a secret key for decrypting it. In this case, the public key can remain on the server or data acquisition unit, while the secret key is split and the key fragments are stored in different locations, particularly on the distributed servers described above. In both cases, the key is specifically divided in such a way that the individual fragments do not allow any conclusions to be drawn about the original key. To achieve this, a so-called 'secret sharing scheme', such as 'additive secret sharing' or 'Shamir secret sharing', can be used to split the key.

[0014] In additive secret sharing, the key q ∈ ℤ N into different parts (shares) (q i ) 1≤i<ndivided and passed on to n parties, i.e., in this case, stored in n different locations. The individual parts q i are chosen in such a way that the following applies: ∑i=0nqi=q mod N

[0015] Equation (1) makes it clear that in this scheme all parts q i necessary to reconstruct the key.

[0016] "Shamir Secret Sharing" is based on polynomial interpolation. It uses a polynomial p of degree t - 1 in a finite field. F defined such that the secret value (in this case the value of the key) q = p(0). p(x)=a0+a1x+a2x2+…+at−1xt−1

[0017] For n parties, different random points are selected in pairs, and each party P i receives the following parts: qi=(xi,p(xi)), i=1,2,…,n,xi≠0

[0018] To decrypt the secret value, a number of t parts q are required. i from n parties (t < n). Thus, in this case, the secret value can also be determined even if not all parts q are present. i are available.

[0019] The Langrange interpolation formula can be used, for example, to reconstruct the polynomial.

[0020] With regard to the application of a secret-sharing scheme as described above, the first multi-party computation protocol includes the division of the key into the individual parts q. i , while the reconstruction of the same is carried out within the framework of a second multi-party calculation protocol.

[0021] According to the invention, the second multi-party calculation protocol is always executed when the data acquisition unit detects a health impairment of the person. In this case, a predetermined number of stored data records are decrypted using the second multi-party calculation protocol, whereby the key for each data record to be decrypted is reconstructed from the at least two key parts.

[0022] Depending on the chosen secret-sharing scheme, the reconstruction of the key can be carried out, for example, as described above.

[0023] The predetermined number of stored data records could, for example, be a number of the most recently stored data records relevant to the recorded health impairment. For instance, if the data acquisition unit detects an impairment of cardiac activity, a predetermined number of heart rate recordings from the last month can be decoded.

[0024] According to one embodiment, the predetermined number of data records to be decrypted can be determined based on the health impairment. For example, the predetermined number of data records to be decrypted may be lower when detecting a fall than when detecting heart failure. In the first case, current symptoms that may have led to the fall are particularly relevant, whereas determining the cause of the heart failure may require a larger amount of data.

[0025] A person's health impairment can be detected by the data acquisition unit, for example, if it detects an unexpectedly high acceleration during a uniform movement, suggesting a fall. This can be confirmed, for example, if the data acquisition unit detects the person coming to a standstill after the high acceleration occurs. As another example, the data acquisition unit can detect a health impairment if it detects a significant increase in the person's resting heart rate. In this case, additional measurements, such as body temperature, blood pressure, or skin conductance, can be used to verify the health impairment.Furthermore, a predetermined time can be defined in the data acquisition unit during which the corresponding measured variables must lie outside a predetermined range before a conclusion is drawn about a health impairment.

[0026] According to one embodiment, a signal can be sent from the data acquisition unit to at least one of the distributed servers to trigger the second multi-party computing protocol. The signal can be designed, in particular, to allow transmission even with a poor network connection.

[0027] In other words, after detecting a health impairment in a person, the data collection unit can initiate the reconstruction of the keys for a predetermined number of data records by sending a corresponding trigger signal to at least one of the distributed servers. Preferably, the trigger signal is sent in such a way that it can be uniquely attributed to the data collection unit. This can be achieved, for example, by using certificates and digital signatures. This ensures that the reconstruction can only be triggered by the data collection unit, and not, for example, by an unauthorized third party. After receiving the trigger signal, the at least one external server can request the remaining key components of the respective data records from the other servers and reconstruct the keys for the predetermined number of data records.

[0028] In order to make a targeted selection of the data sets to be decrypted, the trigger signal can include information about the type of health impairment and / or the current condition of the person concerned.

[0029] If one of the at least two key components for a data record to be decrypted is stored in the data acquisition unit, it can be sent to the at least one server, either as an alternative or in addition to the trigger signal, to trigger the second multi-party calculation protocol. This can accelerate the reconstruction of the predetermined number of data records.

[0030] According to one embodiment, the signal and / or at least one of the two key components can be sent from the data acquisition unit to the at least one server via at least one other unit suitable for data transmission. For example, the data acquisition unit can send the signal to all available network participants (e.g., internet and / or mobile network) so that they can forward the signal to the at least one server. Suitable data transmission units can be smartphones, other wearables, tablets, and other computer systems connected to the network. Forwarding can occur via multiple devices. This can be advantageous, for example, if the data acquisition unit has no or only limited access to the network, e.g., due to damage related to an emergency.

[0031] In this case, the signal can be sent via a first radio link to at least one unit suitable for data transmission, and from there via a second radio link to at least one server. If a network connection is unavailable, the data acquisition unit can send the signal, for example, via a short-range radio link such as Bluetooth, NFC, etc., to devices in close proximity, and these devices can then forward the signal to the server via the network connection (Internet, mobile network, etc.).

[0032] According to one embodiment, a predetermined number of stored data records, or a link to that predetermined number of stored data records, can be sent to a medical facility. In other words, after decrypting the predetermined number of data records using the second multi-party computing protocol, the at least one server can send the decrypted data records, or a link to them (e.g., a hyperlink), over the network to an emergency call center, a hospital, a doctor's office, or a specially designed service. This can be done, in particular, in conjunction with an emergency call, e.g., to the emergency call center, so that the necessary information for providing optimal care to the affected person is available there as early as possible. The transmission of the data or the link over the network can again be carried out, for example, using end-to-end encryption.In this way, relevant parties, such as doctors or paramedics, can obtain important information about the person's state of health, even if the person is unresponsive, the data collection unit was destroyed during the emergency, and / or no network connection is available to retrieve the data from the data collection unit.

[0033] According to one embodiment, the link to the predetermined number of stored data records, e.g., as a hyperlink, can also be sent to the data collection unit. This unit can then display the hyperlink, for example, on a screen, so that other people assisting the affected person can access the predetermined number of data records using their network-enabled devices. In particular, the link / hyperlink can be displayed as a readable code, e.g., a QR code. The display can either be attached to the data collection unit itself, e.g., as the display of a smartwatch, or be located on / in a device connected to the data collection unit, e.g., a smartphone.

[0034] A computing unit according to the invention or an arrangement of several computing units, e.g. comprising a data acquisition unit and / or a server, is in particular programmed to carry out a method according to the invention.

[0035] Implementing a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous, as this incurs particularly low costs, especially if an executing control unit is already available for other tasks. Finally, a machine-readable storage medium is provided with a computer program stored on it as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical, and electrical storage media, such as hard drives, flash memory, EEPROMs, DVDs, etc. Downloading a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be wired or wireless (e.g., via a WLAN network, a 3G, 4G, 5G, or 6G connection, etc.).

[0036] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.

[0037] The invention is schematically illustrated with reference to exemplary embodiments in the drawings and is described below with reference to the drawings. Brief description of the drawings

[0038] Fig. 1a and Fig. Figure 1b schematically shows an encrypted storage of data records and an event-driven decryption of a predetermined number of data records according to an embodiment of the invention. embodiment(s) of the invention

[0039] The Fig. 1a and Fig. Figure 1b schematically shows an encrypted storage of data, such as health data records of a person, as well as an event-driven decryption of a predetermined number of data records according to an embodiment of the invention.

[0040] In Fig. Figure 1a schematically depicts a person 10 running, wearing a data acquisition unit 11 of any design on their body, particularly on their arm. For example, the wearable data acquisition unit 11 could be a fitness tracker or a smartwatch. Specifically, the data acquisition unit 11 can determine and monitor bodily functions such as movement, heart rate, blood pressure, blood glucose level, body temperature, and / or calorie consumption. For this purpose, it can include, for example, sensors for measuring pulse, heart rate, blood pressure, skin conductance, as well as accelerometers and sensors for location determination.

[0041] The data acquisition unit 11 records a large number of data records 120, which are sent via a network connection to an external server 20a, which may in particular be a cloud server (indicated by the arrow between person 10 and server 20a). In this case, the data records 120 may, for example, contain one or more heart rate profiles of person 10 depending on their running speed.

[0042] The data records 120 can be protected from unauthorized access during data transfer, for example, by end-to-end encryption. Data transfer between server 20a and data acquisition unit 11 is not limited to the direction indicated by the arrow; it is also possible for data to be sent from server 20a to data acquisition unit 11.

[0043] In a simple implementation, a symbolically represented key 16 can be generated on server 20a for each data record 12 to be stored. This key can then be divided into several key parts 16a–16c using a first multi-party computation protocol. A secret-sharing scheme, such as 'Shamir Secret Sharing', can be used to generate the key parts 16a–16c. This makes it possible to generate key parts 16a–16c from which no conclusions can be drawn about the key 16 on their own. In the illustrated case, the key 16 is divided into three symbolically represented key parts 16a–16c, which are distributed and stored on servers 20b–20d (indicated by the arrows from server 20a to servers 20b–20d). It is also possible that one of the key parts 16a - 16c remains on server 20a or is sent back to data acquisition unit 11.

[0044] In an alternative configuration offering greater security, the key 16 is generated on the data acquisition unit 11 and then, for example, split into four parts that can be stored on servers 20a–20d. This increases the security of the process, as server 20a has no way of decrypting the data.

[0045] The servers 20a-20d shown can be distributed across different parties and, in particular, configured to participate in a multi-party computation protocol, as referenced in the introduction. The different parties can be, for example, private operators, government agencies, insurance companies, medical practices, and / or hospitals specializing in the storage of health data. The servers 20a-20d can be, for example, cloud servers that are interconnected via a network, such as the internet. Other server types are also possible, and the servers 20a-20d can be implemented as hardware or software servers. In particular, the servers 20a-20d shown can include so-called "virtual cloud providers" (VCPs) as described in EP 4 044 496 A1.

[0046] The division of the key 16 using the first multi-party computation protocol and the distributed storage of the key parts 16a - 16c on the servers 20b - 20d enables secure storage of the data records 120.

[0047] In an emergency, however, it can be vital that relevant health data of an affected person is available to helping parties, such as doctors and paramedics. This is ensured by the procedure shown, as well as by how... Fig. 1b illustrated.

[0048] In Fig. Figure 1b schematically shows a fall of the running person 10, which is detected by the data acquisition unit 11. The fall can be detected by the data acquisition unit 11, for example, by measuring an unexpectedly high acceleration of the person 10 in conjunction with subsequent standstill.

[0049] The data acquisition unit 11 then sends a trigger signal to server 20a (indicated by a lightning bolt on the arrow between person 10 and server 20a), whereupon the server 20a requests the distributed key fragments 16a-16c for a predetermined number of relevant data records 120a from the distributed servers 20b-20d (indicated by the arrows from servers 20b-20d to key 16). It is also possible for the data acquisition unit 11 to send the trigger signal to one of the servers 20b-20d, which then requests the key fragments from the other two servers 20b-20d. In embodiments of the invention, the trigger signal is provided with a certificate or signature that uniquely assigns it to the data acquisition unit, ensuring that no unauthorized third party can trigger the signal.

[0050] In order to make a targeted selection of the data sets to be decrypted 120a, the trigger signal can, for example, include information about the fall as a type of health impairment and about the current condition of person 10 (e.g. location information, current data on the person's bodily functions).

[0051] In one implementation, one of the servers 20b-20d, for example using 'Shamir Secret Sharing', determines the originally generated key 16 from the individual key fragments 16a-16c for each of the predetermined number of stored data records 120a within the framework of a second multi-party computation protocol and sends this key back to server 20a. The data records 120a are then transmitted, for example, along with an emergency call, to a symbolically represented emergency control center 30 (represented by the arrow between server 20a and element 30). Thus, important information about the health status of person 10 is already available there, which can be provided to the treating physicians / paramedics. The data transfer to the emergency control center 30 can, in turn, be secured with end-to-end encryption.If a key component is stored in data acquisition unit 11 in a given configuration, key 16 can also be generated there and sent to server 20a. Regardless of whether a key component is also stored in server 20a, key 16 can also be generated there if key components 16a–16c are transferred to server 20a or are already present there.

[0052] In addition, a hyperlink @120a to the predetermined number of stored data records 120a is sent to the data collection unit 11 (indicated by the arrow between the server 20a and the data collection unit 11). This unit can then display the hyperlink @120a, for example on a display (not shown), so that, for example, other persons who come to the aid of the affected person 10 can access the predetermined number of data records 120a using their network-enabled devices and thus provide targeted assistance.

[0053] In summary, this enables the Fig. 1a and Fig. 1b schematically shows a method for storing sensitive medical data of a person 10, recorded by a data acquisition device 11, in encrypted form in an insecure environment, e.g., on a cloud server 20a, and for selectively decrypting the data if a health impairment of the person 10 is detected, e.g., in the event of a fall. This ensures both the secure storage of personal data and access to necessary information in an emergency. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] EP 4 044 496 A1 [0003, 0012, 0045]

Claims

[1] Method for encrypted storage and event-dependent decryption of recorded data, whereby a plurality of data sets (120) are recorded by means of a data acquisition unit (11) wearable on the body of a person (10), the plurality of data records (120) are stored in encrypted form outside the data acquisition unit (11), wherein a separate key (16) is generated for each data record (120), which is divided into at least two key parts (16a - 16c) by means of a first multi-party calculation protocol, which are stored at different locations, and if a health impairment of the person (10) is detected by the data acquisition unit (11), a predetermined number of stored data records (120a) are decrypted by means of a second multi-party computation protocol, wherein the key (16) for each data record (120a) to be decrypted is reconstructed from the at least two key parts (16a - 16c). [2] Method according to claim 1, wherein one of the at least two key parts (16a - 16c) is stored in the data acquisition unit (11) and all other key parts (16a - 16c) are stored in distributed servers (20a - 20d), or wherein all key parts (16a - 16c) are stored in the distributed servers (20a - 20d). [3] Method according to claim 1 or 2, wherein to trigger the second multi-party calculation protocol a signal is sent from the data acquisition unit (11) to at least one of the distributed servers (20a - 20d). [4] Method according to claim 3, wherein, if one of the at least two key parts (16a - 16c) is stored in the data acquisition unit (11), it is sent to the at least one of the distributed servers (20a - 20d) to trigger the second multi-party calculation protocol. [5] Method according to claim 3 or 4, wherein the signal and / or the at least one of the two key parts (16a - 16c) is sent from the data acquisition unit (11) via at least one further unit suitable for data transmission to the at least one of the distributed servers (20a - 20d). [6] Method according to claim 5, wherein the signal is sent by means of a first radio connection to the at least one unit suitable for data transmission, and is sent from this by means of a second radio connection to the at least one of the distributed servers (20a - 20d). [7] Method according to one of the preceding claims, wherein the predetermined number of data sets (120a) to be decrypted is determined based on the health impairment. [8] Method according to one of the preceding claims, wherein the predetermined number of stored data records (120a) or a link to the predetermined number of stored data records (120a) is sent to a medical device (30). [9] Method according to one of the preceding claims, wherein a link to the predetermined number of stored data records (120a) is sent to the data acquisition unit (11). [10] Method according to claim 9, wherein the link sent to the data acquisition unit (11), in particular as a readable code, is displayed by the data acquisition unit (11). [11] Computing unit or arrangement comprising several computing units, which is designed to carry out all method steps of a method according to one of the preceding claims. [12] Computer program which causes a computing unit or an arrangement of several computing units to carry out all the method steps of a method according to one of claims 1 to 10 when it is executed on the computing unit. [13] A machine-readable storage medium having stored thereon a computer program according to claim 12.

Images