KR102615618B1 - Medical information de-identification system - Google Patents

Abstract

This is a technology developed through the Seoul Business Agency (2021 4th Seoul Innovation Challenge Final) (IC210004) (Development and commercialization of blockchain-based rare disease data portal). The present invention discloses a medical information de-identification system. The medical information de-identification system includes an identification unit that receives medical information from a provider and identifies personal information, a combining unit that combines additional information with the personal information to generate combined information, and encrypts the combined information to create password information. It includes an encryption unit that generates and a reconstruction unit that adds the encryption information to the medical information and reconstructs it to generate de-identified information.

Description

Medical information de-identification system}

The present invention relates to a medical information de-identification system. Specifically, the present invention relates to a medical information de-identification system that maximizes the de-identification effect through other additional information when encrypting personal information.

This is a technology developed through the Seoul Business Agency (2021 4th Seoul Innovation Challenge Final) (IC210004) (Development and commercialization of blockchain-based rare disease data portal). Medical information contains personal information, and if such personal information is leaked to others, it can cause harm to the individual, so legal sanctions exist to prevent this. The three laws, so-called the three data laws, are the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (abbreviated name: Information and Communications Network Act), and the Act on Use and Protection of Credit Information (abbreviated name: Credit Information Act). Information Act)”.

These three data laws stipulate that in order to handle personally identifiable information, the consent of each individual must be obtained or de-identified processing must be performed. However, in the case of de-identification processing, if it is performed too strongly, it will greatly limit the use of data, and if it is performed too weakly, a leak of personal information may occur.

Therefore, maintaining an appropriate level of de-identification is one of the most important matters.

The object of the present invention is to provide a highly efficient medical information de-identification system.

The objects of the present invention are not limited to the objects mentioned above, and other objects and advantages of the present invention that are not mentioned can be understood by the following description and will be more clearly understood by the examples of the present invention. Additionally, it will be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the patent claims.

To solve the above problems, a medical information de-identification system according to some embodiments of the present invention receives medical information from a provider, creates an identification unit that identifies personal information, and combines additional information with the personal information to generate combined information. It includes a combining unit that encrypts the combined information to generate encryption information, and a reconstruction unit that adds the encryption information to the medical information and reconstructs it to generate de-identified information.

The medical information de-identification system of the present invention can increase the degree of de-identification by performing encryption by adding additional information to the information that needs to be de-identified.

In addition to the above-described content, specific effects of the present invention are described below while explaining specific details for carrying out the invention.

1 is a conceptual diagram illustrating a medical information de-identification system according to some embodiments of the present invention.
FIG. 2 is a block diagram for explaining in detail the structure of the server of FIG. 1.
FIG. 3 is a block diagram to explain the medical information of FIG. 1 in detail.
Figure 4 is a block diagram for explaining the extraction unit of Figure 2 in detail.
Figure 5 is a block diagram for explaining the coupling part of Figure 2 in detail.
FIG. 6 is a block diagram for explaining in detail the de-identified information of FIG. 1.
Figure 7 is a block diagram illustrating a medical information de-identification system according to some embodiments of the present invention.
FIG. 8 is a block diagram for explaining the coupling portion of FIG. 7 in detail.
Figure 9 is a block diagram for explaining a medical information de-identification system according to some embodiments of the present invention.
FIG. 10 is a block diagram for explaining the random extraction unit of FIG. 9 in detail.

Terms or words used in this specification and patent claims should not be construed as limited to their general or dictionary meaning. According to the principle that the inventor can define terms or word concepts in order to explain his or her invention in the best way, it should be interpreted with a meaning and concept consistent with the technical idea of the present invention. In addition, the embodiments described in this specification and the configurations shown in the drawings are only one embodiment of the present invention and do not completely represent the technical idea of the present invention, so they cannot be replaced at the time of filing the present application. It should be understood that there may be various equivalents, variations, and applicable examples.

Terms such as first, second, A, and B used in the present specification and claims may be used to describe various components, but the components should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, a first component may be named a second component, and similarly, the second component may also be named a first component without departing from the scope of the present invention. The term 'and/or' includes any of a plurality of related stated items or a combination of a plurality of related stated items.

The terms used in the specification and claims are merely used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as "include" or "have" should be understood as not precluding the existence or addition possibility of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification. .

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by a person of ordinary skill in the technical field to which the present invention pertains.

Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless clearly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

Additionally, each configuration, process, process, or method included in each embodiment of the present invention may be shared within the scope of not being technically contradictory to each other.

Hereinafter, with reference to FIGS. 1 to 6, a medical information de-identification system according to some embodiments of the present invention will be described.

1 is a conceptual diagram illustrating a medical information de-identification system according to some embodiments of the present invention.

Referring to FIG. 1, the medical information de-identification system according to some embodiments of the present invention includes a first server 200, receives medical information (Ipm) from the provider 100, and transmits the medical information (Ipm) to the researcher 300. Identification information (Idm) can be provided.

Provider 100 may generate medical information (Ipm). Specifically, the provider 100 can obtain medical information (Ipm), which is information about the person's health. That is, all information that the provider 100 receives from a medical institution or already possesses may be included in the medical information (Ipm). Additionally, the medical information (Ipm) may include all information related to the medical institution, such as the provider 100's treatment history, medication history, hospitalization history, etc.

The first server 200 may receive medical information (Ipm) from the provider 100. The first server 200 may process medical information (Ipm) to generate de-identified information (Idm). The first server 200 may provide de-identified information (Idm) to the researcher 300.

At this time, the first server 200 is a workstation, a data center, an internet data center (IDC), a direct attached storage (DAS) system, a storage area network (SAN) system, and a network attached (NAS) system. storage) system and a RAID (redundant array of inexpensive disks, or redundant array of independent disks) system, but the present embodiment is not limited thereto.

The first server 200 may transmit data through a network. Networks may include networks based on wired Internet technology, wireless Internet technology, and short-distance communication technology. Wired Internet technology may include, for example, at least one of a local area network (LAN) and a wide area network (WAN).

Wireless Internet technologies include, for example, Wireless LAN (WLAN), DLNA (Digital Living Network Alliance), Wibro (Wireless Broadband), Wimax (World Interoperability for Microwave Access: Wimax), and HSDPA (High Speed Downlink Packet). Access), HSUPA (High Speed Uplink Packet Access), IEEE 802.16, Long Term Evolution (LTE), LTE-A (Long Term Evolution-Advanced), Wireless Mobile Broadband Service (WMBS) and 5G NR (New Radio) technology. However, this embodiment is not limited to this.

Short-range communication technologies include, for example, Bluetooth, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra-Wideband (UWB), ZigBee, and Near Field Communication. At least one of NFC), Ultrasound Communication (USC), Visible Light Communication (VLC), Wi-Fi, Wi-Fi Direct, and 5G NR (New Radio) may include. However, this embodiment is not limited to this.

The first server 200, provider 100, and researcher 300 that communicate through the network can comply with technical standards and standard communication methods for mobile communication. For example, standard communication methods include GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), CDMA2000 (Code Division Multi Access 2000), and EV-DO (Enhanced Voice-Data Optimized or Enhanced Voice-Data Only). , at least one of Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), Long Term Evolution (LTE), Long Term Evolution-Advanced (LTEA), and 5G New Radio (NR) may include. However, this embodiment is not limited to this.

Researchers 300 can conduct research through de-identified information (Idm). At this time, the de-identified information (Idm) may be information that has de-identified the information that can identify an individual within the medical information (Ipm). In other words, the researcher 300 cannot identify an individual through de-identified information (Idm), but can sufficiently conduct medical research through this.

FIG. 2 is a block diagram for explaining in detail the structure of the server of FIG. 1, and FIG. 3 is a block diagram for explaining the medical information of FIG. 1 in detail.

2 and 3, the first server 200 may include an identification unit 210, an extraction unit 220, a first combining unit 230, an encryption unit 240, and a reconstruction unit 250. You can.

The identification unit 210 may receive medical information (Ipm) from the provider 100. The identification unit 210 may identify personal information (Iid) in medical information (Ipm). The identification unit 210 may transmit personal information (Iid) to the first combination unit 230.

Referring to FIGS. 1 and 3, medical information (Ipm) may consist of various fields. One field may be medical information for one provider (100). Although only one row, that is, medical information for one provider 100, is shown in FIG. 3, the present embodiment is not limited thereto. That is, there may be two or more providers 100 and rows.

Medical information (Ipm) may include personal information (Iid) and non-personal information (Idid). Personal information (Id) may be information that can identify an individual, and non-personal information (Idid) may be information that cannot identify an individual. At this time, medical information (Ipm) that is not personal information (Iid) may be non-personal information (Idid). However, this embodiment is not limited to this.

Personal information (Iid) may include, for example, at least one of a number, name, phone number, CI (Connecting Information), DI (Duplicate Information), date of birth, and gender. However, this embodiment is not limited to this. Personal information (Iid) may also include other identifying items such as social security number.

Non-personal information (Idid) may be information about the medical care of an individual identified by personal information (Id). Non-personal information (Idid) may be information about ophthalmology, as shown in FIG. 3. That is, the non-personal information (Idid) may include at least one of the myopia power, astigmatism power, and astigmatism axis of each eye. Alternatively, non-personal information (Idid) may be information obtained in various ways, such as blood tests, ultrasound examinations, tissue examinations, questionnaires, and measurements, and may refer to information that is difficult to identify an individual.

Again, referring to FIG. 2, the extraction unit 220 may receive medical information (Ipm). The extraction unit 220 may also receive personal information (Iid) from the identification unit 210. Through this, the extraction unit 220 can generate additional information (Iad) by extracting at least part of the medical information (Ipm) from an area that is not personal information (Iid) (i.e., non-personal information (Idid)). The extraction unit 220 may transmit additional information (Iad) to the first combining unit 230.

The first combining unit 230 may receive personal information (Iid) and additional information (Iad) and combine them. The first combination unit 230 may generate combined information (Icm) by combining personal information (Iid) and additional information (Iad). At this time, the combination information (Icm) may be generated as a hex code. However, this embodiment is not limited to this. The first combination unit 230 may transmit the combination information (Icm) to the encryption unit 240.

The encryption unit 240 may generate encryption information (Ien) by encrypting the combination information (Icm). The encryption unit 240 can maintain a higher level of security than general encryption by encrypting the combined information (Icm) that combines not only personal information (Iid) but also additional information (Iad). That is, even if the encrypted content is decrypted, only the combined information (Icm) can be known, and it may be difficult to separate the personal information (Iid) from the combined information (Icm). In addition, as the encryption input becomes longer, the difficulty of decryption also increases, which can increase the security level.

The encryption unit 240 may perform encryption using a hash function. However, this embodiment is not limited to this. The hash function of the encryption unit 240 may be used twice or more. Through this, the level of security and de-identification can be improved.

As the encryption unit 240 uses a hash function, an integrity check may be possible when a verification request for other information is provided later. At this time, rather than simply passing only the personal information (Iid) through the hash function to verify it, adding additional information (Iad) and passing it through the hash function can further improve the performance of the integrity check.

The encryption unit 240 may generate encryption information (Ien), which is the result of encryption, and transmit it to the reconstruction unit 250.

The reconstruction unit 250 may receive medical information (Ipm). The reconstruction unit 250 may also receive encryption information (Ien). The reconstruction unit 250 may reconstruct the personal information (Iid) in the medical information (Ipm) and replace it with password information (Ien). Accordingly, the medical information (Ipm) can be reconstructed and converted into de-identified information (Idm). The reconstruction unit 250 may provide de-identified information (Idm) to the researcher 300.

Figure 4 is a block diagram for explaining the extraction unit of Figure 2 in detail.

Referring to FIG. 4 , the extraction unit 220 may include a first extraction module 221, a first hex module 222, and a second extraction module 223.

The first extraction module 221 may receive medical information (Ipm) and personal information (Iid). The first extraction module 221 may generate non-personal information (Idid) excluding personal information (Iid) from medical information (Ipm). Specifically, the first extraction module 221 may generate non-personal information (Idid) by removing personal information (Id) from medical information (Ipm). However, this embodiment is not limited to this.

The first hex module 222 may receive non-personal information (Idid). The first hex module 222 can convert non-personal information (Idid) into hex code. At this time, hex code is a method of expressing color using hexadecimal numbers, and all types of data can be expressed as hex code. The first hex module 222 may generate first hex information (Ih1) by converting non-personal information (Idid).

The second extraction module 223 may receive first hex information (Ih1). The second extraction module 223 may extract part of the first hex information (Ih1). At this time, the second extraction module 223 may perform extraction based on preset standards. For example, the preset standard may mean which element of the sequence is extracted since the first hex information (Ih1) is expressed as a sequence of letters and numbers. In other words, the preset standard may be 'when extracting the 3rd, 5th, 8th, and 15th elements.' Alternatively, the preset criteria may be determined in other ways, such as '1st number', '15th character', etc. Alternatively, if the first element is selected based on a specific standard, it may be possible to select the element third before the first element as the second element. In other words, the preset standards can be as diverse as possible.

The form of the first hex information (Ih1) may vary depending on the non-personal information (Idid), so even if a preset standard is set, the information extracted as a result may be in an arbitrary form. This randomness can make the subsequent encryption process more complicated.

The second extraction module 223 may generate additional information (Iad) by performing extraction from the first hex information (Ih1). Additional information (Iad) can be added in the form of a hex code. However, this embodiment is not limited to this.

Figure 5 is a block diagram for explaining the coupling part of Figure 2 in detail.

Referring to FIG. 5, the first coupling unit 230 may include a second hex module 231 and a hex coupling module 232.

The second hex module 231 can receive personal information (Iid). The second hex module 231 can convert personal information (Iid) into hex code. The second hex module 231 may generate second hex information (Ih2) by converting personal information (Iid) into a hex code.

The hex combination module 232 may receive second hex information (Ih2). The hex combination module 232 may receive additional information (Iad). The hex combination module 232 may combine additional information (Iad) and second hex information (Ih2). The hex combination module 232 may generate combination information (Icm) by combining the additional information (Iad) and the second hex information (Ih2). The combining method of the hex combining module 232 may simply be a method of concatenating the additional information (Iad) and the second hex information (Ih2) back and forth. At this time, the order of the additional information (Iad) and the second hex information (Ih2) may be the order of the additional information (Iad) and the second hex information (Ih2) or vice versa.

Alternatively, the hex combination module 232 may combine the additional information (Iad) and the second hex information (Ih2) according to other preset criteria. For example, the additional information (Iad) may be divided and placed in even-numbered positions, and the second hex information (Ih2) may be divided and placed in odd-numbered positions. However, this embodiment is not limited to this and various methods may be possible.

FIG. 6 is a block diagram for explaining in detail the de-identified information of FIG. 1.

Referring to FIG. 6, de-identified information (Idm) may be generated by replacing the personal information (Iid) part of the existing medical information (Ipm) with password information (Ien). Accordingly, the de-identified information (Idm) may include password information (Ien) and non-personal information (Idid). At this time, the non-personal information (Idid) may be information excluding the password information (Ien) from the de-identified information (Idm).

The medical information de-identification system according to this embodiment can prevent personal information leakage while providing researchers with information for research. Additionally, as the complexity of encryption of personal information increases, the possibility of decryption by hackers can be greatly reduced.

Additionally, the medical information de-identification system according to this embodiment can store and store medical information (Ipm) and de-identified information (Idm) in a blockchain. Accordingly, it is reliably authenticated that the de-identified information (Idm) has not been changed later, and through this, the integrity check of the changed information can also be performed more accurately.

At this time, encryption can be performed not only through personal information (Iid) but also through additional information (Iad), and when using a hash function, a hash value can be generated, further improving the reliability of the integrity check.

Hereinafter, with reference to FIGS. 7 and 8, a medical information de-identification system according to some embodiments of the present invention will be described. Descriptions that overlap with the above-described embodiments will be simplified or omitted.

Figure 7 is a block diagram illustrating a medical information de-identification system according to some embodiments of the present invention.

Referring to FIG. 7 , the second server 200_1 may not include the extraction unit 220 of FIG. 2 but may include a second coupling unit 230_1. The second combination unit 230_1 may generate combination information (Icm) without receiving the additional information (Iad) of FIG. 2.

FIG. 8 is a block diagram for explaining the coupling portion of FIG. 7 in detail.

Referring to FIG. 8 , the second coupling unit 230_1 may include a code database 233.

The code database 233 may store additional hex codes (hc) in advance. The code database 233 may transmit a pre-stored additional hex code (hc) to the hex combination module 232.

The hex combination module 232 may receive second hex information (Ih2) and additional hex code (hc). The hex combination module 232 may generate combination information (Icm) by combining the second hex information (Ih2) and the additional hex code (hc).

The combining method of the hex combining module 232 may simply be a method of concatenating the additional hex code (hc) and the second hex information (Ih2) back and forth. At this time, the order of the additional hex code (hc) and the second hex information (Ih2) may be the order of the additional hex code (hc) and the second hex information (Ih2) or vice versa. Alternatively, the hex combination module 232 may combine the additional hex code (hc) and the second hex information (Ih2) according to other preset criteria.

This embodiment uses a pre-stored additional hex code (hc) rather than retrieving additional information (Iad) from medical information (Ipm), and uses an additional hex code (hc) that is completely unrelated to personal information (Iid). Security can be further improved.

Hereinafter, with reference to FIGS. 9 and 10, a medical information de-identification system according to some embodiments of the present invention will be described. Descriptions that overlap with the above-described embodiments will be simplified or omitted.

Figure 9 is a block diagram for explaining a medical information de-identification system according to some embodiments of the present invention.

Referring to FIG. 9, the third server 200_2 may include a random extraction unit 220_1 instead of the extraction unit 220 of FIG. 2. The random extraction unit 220_1 may receive medical information (Ipm) and receive personal information (Iid) from the identification unit 210. Accordingly, the random extraction unit 220_1 may generate additional information (Iad) by randomly extracting information other than personal information (Iid) from the medical information (Ipm).

FIG. 10 is a block diagram for explaining the extraction unit of FIG. 9 in detail.

Referring to FIG. 10 , the random extraction unit 220_1 may further include a third extraction module 223 instead of the second extraction module 223.

The third extraction module 223 may receive first hex information (Ih1). The third extraction module 223 may extract part of the first hex information (Ih1). At this time, the second extraction module 223 may perform extraction randomly rather than based on preset standards. The third extraction module 223 internally performs extraction using a random function, etc., and additional information (Iad) may be generated accordingly.

In this embodiment, a random method is used to generate additional information (Iad) rather than a preset standard, so the degree of freedom of the encryption method is further increased and security can be improved. Accordingly, the probability of leakage of de-identified parts is lowered, allowing the provider 100 to provide medical information (Ipm) more safely.

The above description is merely an illustrative explanation of the technical idea of the present embodiment, and those skilled in the art will be able to make various modifications and variations without departing from the essential characteristics of the present embodiment. Accordingly, the present embodiments are not intended to limit the technical idea of the present embodiment, but rather to explain it, and the scope of the technical idea of the present embodiment is not limited by these examples. The scope of protection of this embodiment should be interpreted in accordance with the claims below, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of rights of this embodiment.

Claims (10)

An identification unit that receives medical information from a provider and identifies personal information included in the medical information;
a combining unit that generates combined information by combining the personal information with additional information extracted from at least a portion of the medical information excluding the personal information;
an encryption unit that encrypts the combined information to generate password information; and
Comprising a reconstruction unit that replaces the personal information in the medical information with the password information and generates de-identified information that reconstructs the medical information.
Medical information de-identification system.
According to claim 1,
The medical information includes the personal information and non-personal information,
The de-identified information includes the password information and the non-personal information,
Medical information de-identification system.
According to clause 2,
Further comprising an extraction unit for extracting the additional information from the medical information.
Medical information de-identification system.
According to clause 3,
The extraction unit,
a first extraction module for extracting the non-personal information from the medical information;
a first hex module that converts the non-personal information into a hex code and generates first hex information;
Comprising a second extraction module that extracts the additional information from a predetermined position among the first hex information.
Medical information de-identification system.
delete According to clause 2,
Further comprising a random extraction unit that randomly extracts the additional information from the medical information.
Medical information de-identification system.
According to clause 6,
The random extraction unit,
a first extraction module for extracting the non-personal information from the medical information;
A first hex module that converts the non-personal information into hex code and generates first hex information,
Comprising a third extraction module that randomly extracts the additional information from the first hex information.
Medical information de-identification system.
According to claim 1,
The coupling part,
a second hex module that converts the personal information into hex code and generates second hex information;
Comprising a hex combining module that combines the second hex information and the additional information to generate the combined information.
Medical information de-identification system.
delete According to claim 1,
The reconstruction unit provides the de-identified information to the researcher.
Medical information de-identification system.

Images