WO2020155622A1 - Method, device and system for enhancing security of image data transmission, and storage medium - Google Patents

Abstract

The present invention relates to the technical field of information security, and more particularly, relates to a method, device and system for enhancing security of image data transmission, and a storage medium. The method comprises: selecting, from medical image data, a first packet of any length to generate an image data summary; using a digital authorization private key to encrypt the image data summary to obtain a digital signature; using a random key to encrypt the medical image data to obtain encrypted image data; using an image data public key to encrypt the random key to obtain an encrypted key; and sending the digital signature, a digital certificate, the encrypted image data and the encrypted key to a cloud terminal of a medical image information system. The method facilitates enhancing the security of remotely transmitting medical image data.

Description

Method, device, system and storage medium for improving image data transmission security

【cross reference】

This application is based on the Chinese invention patent application filed on January 28, 2019, with the application number 2019100820696, titled "Methods, Devices, Systems and Storage Media for Improving the Security of Image Data Transmission", and claims priority.

【Technical Field】

This application belongs to the field of information security technology, and relates to methods, devices, systems, and storage media for improving the security of image data transmission.

【Background technique】

PACS (Picture Archiving and Communication Systems) system is mainly used in the system of hospital imaging department. The main task of the PACS system is to digitalize various medical images (including images produced by nuclear magnetism, CT, ultrasound, various X-ray machines, various infrared instruments, microscopes and other equipment) through various interfaces. Mass storage, when needed, can be quickly transferred back to use under certain authorization, while adding some auxiliary diagnosis management functions.

Under the existing technical conditions, the remote transmission of medical image data of the PACS system is generally transmitted through DICOM (Digital Imaging and Communications in Medicine, medical digital imaging and communication network protocol), because it is in the local area network or VPN private network (Virtual Private Network, virtual private network). Private network), the security of remote data transmission is not high, so under the existing technical conditions, the PACS system cannot guarantee the security when transmitting medical image data to the cloud of the PACS system.

[Content of the invention]

The embodiments of the present application disclose methods, devices, systems and storage media for improving the security of image data transmission, aiming to improve the security of remote transmission of medical image data.

An embodiment of the present application discloses a method for improving the security of image data transmission, applied to a terminal of a medical image information system, including: selecting a first message of any length from medical image data to generate an image data summary; Authorize the private key to encrypt the image data digest to obtain a digital signature; encrypt the medical image data with a random key to obtain image encrypted data; to encrypt the random key with the image data public key to obtain an encrypted secret Key; sending the digital signature, the digital certificate, the image encryption data and the encryption key to the cloud of the medical imaging information system.

An embodiment of the application discloses a method for improving the security of image data transmission, which is applied to the cloud of a medical image information system, and is characterized in that it includes: receiving a digital certificate, a digital signature, image encryption data, and an encryption key; The digital certificate is validated; when it is verified that the digital certificate is valid, the digital authorization public key in the digital authorization key pair is used to decrypt the digital signature to obtain an image data digest; when the digital authorization is used When the digital authorized public key in the key pair decrypts the digital signature to obtain the image data digest, the image data private key in the image data key pair is used to decrypt the encryption key to obtain a random key When using the image data private key in the image data key pair to decrypt the encryption key to obtain the random key, use the random key to decrypt the image encrypted data to obtain the The medical image data; compare the image data abstract with the medical image data; when the image data abstract is consistent with the corresponding part in the medical image data, confirm that the medical image data passes safety verification.

An embodiment of the present application discloses a device for improving the security of image data transmission, which is applied to a terminal of a medical image information system, and includes: an image data summary generating module for selecting a first message of any length from medical image data Generated as an image data digest; a digital signature generation module for encrypting the image data digest with a digitally authorized private key to obtain a digital signature; an image encryption data generating module for encrypting the medical image data with a random key Then obtain the image encrypted data; an encryption key generation module for encrypting the random key with the image data public key to obtain an encryption key; a sending module for sending the digital signature, the digital certificate, and the The image encryption data and the encryption key are sent to the cloud of the medical image information system.

An embodiment of the application discloses a device for improving the security of image data transmission, which is applied to the cloud of a medical image information system, and includes: a receiving module for receiving digital certificates, digital signatures, image encryption data, and encryption keys; digital The certificate verification module is used to verify the validity of the digital certificate; the digital certificate decryption module is used to use the digital authorization public key in the digital authorization key pair to give the digital certificate when the digital certificate is valid. Signature decryption to obtain an image data digest; an encryption key decryption module for using the image when the digital authorization public key in the digital authorization key pair is used to decrypt the digital signature to obtain the image data digest The image data private key in the data key pair is decrypted to the encryption key to obtain a random key; the image encryption data decryption module is used for when using the image data private key in the image data key pair to When the encryption key is decrypted to obtain the random key, the random key is used to decrypt the image encrypted data to obtain the medical image data; an image data digest comparison module is used to compare the image data The abstract is compared with the medical image data; when the image data abstract is consistent with the corresponding part in the medical image data, it is confirmed that the medical image data passes the security verification.

Some embodiments of the application disclose a medical imaging information system, which includes a cloud and at least one terminal communicatively connected to the cloud; the terminal includes at least one first memory and at least one first processor, the first A first computer program is stored in the memory, and when the first computer program is executed by the first processor, the method for improving the security of image data transmission applied to the terminal is realized.

The cloud includes at least one second memory and at least one second processor. A second computer program is stored in the second memory. When the second computer program is executed by the second processor, it is applied to the Cloud-based methods to improve the security of image data transmission.

Some embodiments of the present application disclose a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned improved image data transmission applied to the terminal is realized A secure method or a method applied to the cloud to improve the security of image data transmission.

Compared with the prior art, the technical solution disclosed in this application mainly has the following beneficial effects:

In the embodiment of the present application, the method for improving the security of image data transmission applied to the terminal first selects a first message of any length from the medical image data to generate an image data summary, and then privately authorizes the image data. The key encrypts the image data digest to obtain a digital signature, and then encrypts the medical image data with a random key to obtain image encrypted data, and then encrypts the random key with the image data public key to obtain an encrypted key key. By setting the above-mentioned multiple encryption steps, it is beneficial to improve the security of the medical image data during the remote transmission process, and is beneficial to improve the security of the medical image data during the remote transmission process.

【Explanation of drawings】

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative labor, other drawings can be obtained from these drawings.

FIG. 1 is a schematic diagram of the method for improving the security of image data transmission by the cloud and the terminal of the PACS system in an embodiment of the application;

2 is a step diagram of a method for improving image data transmission security applied to the terminal in an embodiment of the application;

FIG. 3 is a schematic diagram of the steps of generating the first message as the image data summary in an embodiment of this application;

4 is a schematic diagram of a method for improving the security of image data transmission applied to the cloud in an embodiment of the application;

FIG. 5 is a schematic diagram of the steps of verifying the digital certificate in an embodiment of this application;

FIG. 6 is a schematic diagram of the steps of comparing the image data summary with the same parts in the medical image data in an embodiment of the application;

FIG. 7 is a schematic diagram of the steps in generating the image data key pair in an embodiment of the application;

8 is a schematic diagram of an apparatus for improving the security of image data transmission applied to the terminal in an embodiment of the application;

FIG. 9 is a schematic diagram of the image data summary generating module 10 in an embodiment of the application;

10 is a schematic diagram of an apparatus for improving the security of image data transmission applied to the cloud in an embodiment of the application;

FIG. 11 is a schematic diagram of the digital certificate verification module 200 in an embodiment of the application;

FIG. 12 is a schematic diagram of the image data summary comparison module 600 in an embodiment of the application;

FIG. 13 is a schematic diagram of an apparatus for improving image data transmission security applied to the cloud in another embodiment of the application;

FIG. 14 is a schematic diagram of the image data key pair generation module 70 in an embodiment of the application;

15 is a block diagram of the basic structure of the medical imaging information system in an embodiment of the application.

【detailed description】

In order to facilitate the understanding of the application, the application will be described in a more comprehensive manner with reference to the relevant drawings. The preferred embodiments of the application are shown in the drawings. However, this application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of this application more thorough and comprehensive.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field of this application. The terms used in the specification of the application herein are only for the purpose of describing specific embodiments, and are not intended to limit the application.

In the embodiment of this application, the medical imaging information system is specifically a PACS system (Picture Archiving and Communication Systems for short). The PACS system includes at least one terminal for encryption and a cloud for decryption. The cloud of the PACS system generates a digital certificate, a digital authorization key pair, and an image data key pair. The digital authorization key pair includes a digital authorization private key and a digital authorization public key. The image data key pair includes an image data private key and an image data public key. The cloud shares the generated digital certificate, the digital authorization private key, and the image data public key to the terminal. After the medical image data is collected by the image data collecting device, the medical image data is encrypted through the terminal.

An embodiment of the present application discloses a method for improving the security of image data transmission, which is applied to a terminal of a medical image information system.

1 and FIG. 2, where FIG. 1 is a schematic diagram of the method for improving the security of image data transmission performed by the cloud and the terminal of the PACS system in an embodiment of the application, and FIG. 2 is an implementation of the application In the example, a step diagram of a method for improving the security of image data transmission applied to the terminal.

As shown in Fig. 1, the method for improving the security of image data transmission includes:

Step A1: Select a first message of any length from the medical image data to generate an image data summary.

Specifically, a one-way hash function is used to generate the first message of any length in the medical image data as the image data digest. The first message and the second message mentioned later refer to data units during exchange and transmission in the network, that is, data blocks to be sent by the station at one time.

Referring to FIG. 3, it is a schematic diagram of the steps of generating the first message as the image data summary in an embodiment of this application.

As shown in FIG. 3, in the embodiment of the present application, the step of selecting a first message of any length from the medical image data to generate an image data summary includes:

Step A11: Fill the first message so that the result of the remainder of 512 for the byte length of the first message is equal to 448.

When the byte length of the first message of any length selected is equal to 448, the byte length of the first message will be expanded to (L-1)×512+448, That is (L-1)×64+56 bytes (Bytes), L refers to the byte length.

The step of filling the first message includes: filling a 1 and a certain number of 0s after the first message, and stopping the filling of the first message until it is equal to (L-1)×512+448. Fill in a message.

Step A12: append a second message represented by a 64-bit binary number after the filled first message.

After processing in steps A11 and A12, the byte length of the first message and the second message = (L-1)×512+448+64=L×512, that is, the first message and The byte length of the second message is exactly an integer multiple of 512.

Step A13: Set 4 integer parameters of 32-bit chaining variables.

In the embodiment of the application, the integer parameters of the four 32-bit link variables are: A=0x01234567, B=0x89abcdef, C=0xfedcba98, D=0x76543210.

Step A14: The filled first message and the second message are respectively processed with 512 bits as a packet, and each of the packets is subjected to 4 rounds of transformation, using the 4 32-bit link variables as The initial variable calls 4 bit manipulation functions to calculate the first group.

The 4 bit manipulation functions that need to be called include: F(X, Y, Z)=(X&Y)|((～X)&Z); G(X,Y,Z)=(X&Z)|(Y&(～ Z)); H(X, Y, Z)=X^Y^Z; I(X,Y,Z)=Y^(X|(~Z)).

Step A15: Output the 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping. The 4 variables corresponding to the last group are used as the image data summary.

If the grouping operation performed with the 4 variables is the last grouping, the 4 variables are the first message and the second message of the fixed length, and finally the fixed length The first message and the second message are the image data digest.

Step A2: Encrypt the image data digest with a digital authorized private key to obtain a digital signature (Signature).

Step A3: Encrypt the medical image data with a random key (RandomKey) to obtain image encryption data (EncryptData). The random key (RandomKey) can either encrypt the medical image data or decrypt the encrypted image data.

Step A4: Encrypt the random key (RandomKey) with the image data public key to obtain an encryption key (EncryptKey).

Use the image data public key and the encryption formula m ^e = c (mod n) to encrypt the random key to obtain the encryption key; c is the cipher text of the encryption key, and m is the encryption The plaintext of the encryption key obtained after decrypting the ciphertext of the key, n is the product of two unequal prime numbers p and q, e is an integer, φ(n)>e>1, and e and φ(n ) Is relatively prime, φ(n) refers to the Euler function of n, (n, e) is the public key of the image data; when m≧n, the random key is encrypted in sections.

Step A5: Send the digital signature, the digital certificate, the image encryption data and the encryption key to the cloud of the medical image information system.

In the embodiment of the present application, the method for improving the security of image data transmission applied to the terminal first selects a first message of any length from the medical image data to generate an image data summary, and then privately authorizes the image data. The key encrypts the image data digest to obtain a digital signature, and then encrypts the medical image data with a random key to obtain image encrypted data, and then encrypts the random key with the image data public key to obtain an encrypted key key. By setting the above-mentioned multiple encryption steps, it is beneficial to improve the security of the medical image data in the remote transmission process.

An embodiment of the present application discloses a method for improving the security of image data transmission, which is applied to the cloud of a medical image information system.

1 and 4 are schematic diagrams of a method for improving the security of image data transmission applied to the cloud in an embodiment of the application.

As shown in FIG. 4, in an embodiment of the present application, the method for improving the security of image data transmission includes:

S1: Receive digital certificate, digital signature, image encryption data and encryption key.

The digital certificate, the digital signature, the image encryption data, and the encryption key are provided by the terminal of the PACS system, and transmitted to the cloud of the PACS system through the network. Wherein, the digital certificate is stored in the terminal. The digital signature is obtained by encrypting the image data digest with the digital authorized private key provided by the cloud. The image encryption data is obtained by encrypting the medical image data with a random key. The encryption key is obtained by encrypting the random key with the image data public key provided by the cloud.

In the embodiment of the present application, the way for the cloud to generate the digital certificate includes:

Use the KEYTOOL tool to generate the digital certificate. The KEYTOOL tool is a key and certificate management tool, which can manage the generation and installation of keys and digital certificates in a JAVA environment;

The digital certificate is directly generated through JAVA code. The principle of directly generating the digital certificate by JAVA code is similar to the principle of generating the digital certificate by the KEYTOOL tool;

Use network online tools to obtain digital certificates.

S2: Perform validity verification on the digital certificate.

Referring to FIG. 5, this is a schematic diagram of the steps of verifying the digital certificate described in an embodiment of this application.

As shown in Figure 5, in the embodiment of the present application, the step of verifying the validity of the digital certificate includes:

S21: Verify the credibility of the certificate chain of the digital certificate.

S22: When the certificate chain of the digital certificate is trusted, verify whether the digital certificate is revoked.

S23: When the digital certificate is not revoked, verify whether the digital certificate is within the validity period.

S24: When the digital certificate is within the validity period, verify whether the domain name of the digital certificate matches the current access domain name; when the domain name of the digital certificate matches the current access domain name, confirm the number The certificate passes the validity verification.

S3: When it is verified that the digital certificate is valid, use the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain an image data digest.

S4: When using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest, use the image data private key in the image data key pair to give the encryption key Decrypt the key to obtain a random key.

The step of using the image data private key in the image data key pair to decrypt the encryption key includes: applying the image data private key and a decryption formula to decrypt the cipher text of the encryption key. The decryption formula is c ^d = m(mod n), where (n, d) is the private key of the image data, c is the cipher text of the encryption key, and m is the cipher text of the encryption key The plaintext of the encryption key obtained after decryption.

S5: When using the image data private key in the image data key pair to decrypt the encryption key to obtain the random key, use the random key to decrypt the image encrypted data to obtain The medical imaging data.

S6: Compare the image data summary with the medical image data. When the image data summary is consistent with the corresponding part in the medical image data, it is confirmed that the medical image data passes the security verification.

Refer to FIG. 6, which is a schematic diagram of the steps of comparing the image data summary with the same parts in the medical image data in an embodiment of the application.

As shown in FIG. 6, in some embodiments of the present application, the step of comparing the image data summary with the medical image data includes:

S61: Split the image data summary and import the first data list.

S62: Split the part of the medical image data used to generate the image data summary and import the second data list.

S63: Compare the first data list and the second data list to determine whether the first data list and the second data list are consistent. When the first data list and the second data list are consistent, the safety of the medical image data is verified.

The method for improving the security of image data transmission further includes generating the image data key pair. The image data key pair includes an image data private key and an image data public key.

Referring to FIG. 7, it is a schematic diagram of the steps in generating the image data key pair described in an embodiment of this application.

As shown in FIG. 7, the step of generating the image data key pair includes:

S71: Randomly select two unequal prime numbers p and q.

S72: Calculate the product n of p and q.

S73: Calculate the Euler function φ(n) of n.

S74: Randomly select an integer e, where φ(n)>e>1, and e and φ(n) are relatively prime.

S75: Calculate the modular inverse element d of e to φ(n).

S76: Encapsulate n and e into image data public keys (n, e), and n and d into image data private keys (n, d).

S77: Send the image data public key (n, e) to the terminal that encrypts the plain text of the encryption key.

For example, two unequal prime numbers 47 and 59 are randomly selected. The product of 47 and 59 is 43×57=2773.

The formula for calculating Euler function is φ(n)=n(1-1/p)(1-1/q), according to the formula of Euler function, φ(2773) is calculated, φ(2773)=2773×( 1-1/47)(1-1/59)=(47-1)(59-1)=2668.

Randomly select an integer e=63 between 1 and 2668, 2668>63>1, and 63 and 2668 are relatively prime. Then calculate the inverse element d of 63 for 2668, according to the formula

There is 63d-1=2668k, and d=847 calculated by the Euclidean expansion formula. The image data public key (n, e) = (2773, 63), and the image data private key (n, d) = (2773, 847).

With reference to the above method, the digital authorization key pair can also be generated.

In the embodiment of the present application, the received digital certificate is first verified, so the terminal with invalid digital certificate can be excluded, and the access of the terminal with invalid digital certificate can be denied.

Secondly, when it is verified that the digital certificate is valid, the digital authorization public key in the digital authorization key pair is used to decrypt the digital signature. Further, when the digital authorization public key in the digital authorization key pair is used to decrypt the digital signature to obtain the image data digest, the image data private key in the image data key pair is used for the encryption key Decrypt. When the image data private key in the image data key pair is used to decrypt the encryption key to obtain a random key, the random key is used to decrypt the image encrypted data. By setting the above-mentioned multiple decryption steps, it is beneficial to improve the security of the medical image data in the remote transmission process.

Furthermore, when the random key is used to decrypt the image encrypted data successfully, the medical image data is obtained; the image data abstract is compared with the medical image data; the image data abstract is compared with the medical image data. When the corresponding parts in the medical image data are consistent, the safety of the medical image data is verified. Therefore, the forgery of the digital signature can be fully prevented, which is beneficial to improve the security of the medical image data in the remote transmission process.

An embodiment of the present application discloses a device for improving the security of image data transmission, which is applied to a terminal of a medical image information system.

Referring to FIG. 8, it is a schematic diagram of an apparatus for improving the security of image data transmission applied to the terminal in an embodiment of the application.

As shown in FIG. 8, the device for improving the security of image data transmission includes:

The image data abstract generation module 10 is used to select a first message of any length from the medical image data to generate an image data abstract.

The digital signature generating module 20 is used for encrypting the image data digest with a digital authorized private key to obtain a digital signature.

The image encryption data generation module 30 is used for encrypting the medical image data with a random key to obtain image encryption data.

The encryption key generation module 40 is used to encrypt the random key by the image data public key to obtain an encryption key.

The sending module 50 is configured to send the digital signature, the digital certificate, the image encryption data, and the encryption key to the cloud of the medical image information system.

Refer to FIG. 9, which is a schematic diagram of the image data summary generating module 10 in an embodiment of the application.

In some embodiments of the present application, the image data summary generating module 10 includes:

The first packet filling submodule 11 is configured to fill the first packet so that the result of the remainder of 512 in the byte length of the first packet is equal to 448.

The second message appending submodule 12 is configured to append a second message represented by a 64-bit binary number after the filled first message.

The integer parameter setting submodule 13 is used to set the integer parameters of four 32-bit link variables.

The packet processing sub-module 14 is configured to process the filled first message and the second message with 512 bits as a group, and each of the groups is subjected to 4 rounds of transformation, and the 4 The 32-bit link variable is the starting variable and calls 4 bit operation functions to calculate the first group.

The image data summary output sub-module 15 is used to output the 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping; divide the last grouping The corresponding 4 variables are used as the image data summary.

In some embodiments of the present application, the encryption key generation module 40 uses the image data public key and an encryption formula ^me = c (mod n) to encrypt the random key to obtain the encryption key; c is the ciphertext of the encryption key, m is the plaintext of the encryption key obtained after decrypting the ciphertext of the encryption key, n is the product of two unequal prime numbers p and q, and e is Integer, φ(n)>e>1, and e and φ(n) are relatively prime, φ(n) refers to the Euler function of n, (n, e) is the public key of the image data; when m≧ When n, the random key is encrypted in segments.

An embodiment of the present application discloses a device for improving the security of image data transmission, which is applied to the cloud of a medical image information system.

Referring to FIG. 10, it is a schematic diagram of an apparatus for improving the security of image data transmission applied to the cloud in an embodiment of the application.

As shown in FIG. 10, the device for improving the security of image data transmission includes:

The receiving module 100 is used to receive digital certificates, digital signatures, image encryption data, and encryption keys.

The digital certificate verification module 200 is used to verify the validity of the digital certificate.

The digital certificate decryption module 300 is configured to use the digital authorized public key in the digital authorized key pair to decrypt the digital signature when it is verified that the digital certificate is valid, so as to obtain an image data digest.

The encryption key decryption module 400 is configured to use the image data in the image data key pair when using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest The private key decrypts the encryption key to obtain a random key.

The image encryption data decryption module 500 is used for when the image data private key in the image data key pair is used to decrypt the encryption key to obtain the random key, the random key is used for the The image encryption data is decrypted to obtain the medical image data.

The image data summary comparison module 600 is used to compare the image data summary with the medical image data; when the image data summary is consistent with the corresponding part in the medical image data, confirm the medical image The image data passed the security verification.

In some embodiments of the present application, the encryption key decryption module 400 uses the image data private key and a decryption formula to decrypt the cipher text of the encryption key. The decryption formula is c ^d = m(mod n), where (n, d) is the private key of the image data, c is the cipher text of the encryption key, and m is the cipher text of the encryption key The plaintext of the encryption key obtained after decryption.

Refer to FIG. 11, which is a schematic diagram of the digital certificate verification module 200 in an embodiment of this application.

As shown in FIG. 11, in some embodiments of the present application, the digital certificate verification module 200 includes:

The certificate chain verification sub-module 201 is used to verify the credibility of the certificate chain of the digital certificate.

The revocation verification submodule 202 is configured to verify whether the digital certificate is revoked when the certificate chain of the digital certificate is trusted.

The validity period verification submodule 203 is configured to verify whether the digital certificate is within the validity period when the digital certificate is not revoked.

The domain name verification submodule 204 is configured to verify whether the domain name of the digital certificate matches the current access domain name when the digital certificate is within the validity period. When the domain name of the digital certificate matches the current access domain name, it is confirmed that the digital certificate passes the validity verification.

Referring to FIG. 12, it is a schematic diagram of the image data summary comparison module 600 in an embodiment of the application.

As shown in FIG. 12, in some embodiments of the present application, the image data summary comparison module 600 includes:

The first data list sub-module 601 is used to split the image data summary and import the first data list.

The second data list sub-module 602 is used to split the part of the medical image data used to generate the image data summary and import the second data list.

The data list comparison sub-module 603 is configured to compare the first data list and the second data list to determine whether the first data list and the second data list are consistent.

Refer to FIG. 13, which is a schematic diagram of an apparatus for improving the security of image data transmission applied to the cloud in another embodiment of the application.

As shown in FIG. 13, the device for improving the security of image data transmission further includes an image data key pair generation module 700. The image data key pair generation module 700 is used to generate the image data key pair. The image data key pair includes an image data private key and an image data public key.

Referring to FIG. 14, it is a schematic diagram of the image data key pair generation module 70 in an embodiment of this application.

As shown in FIG. 14, in some embodiments of the present application, the image data key pair generation module 700 includes:

The prime number selection submodule 701 is used to randomly select two unequal prime numbers p and q.

The prime number product calculation sub-module 702 is used to calculate the product n of p and q.

The Euler function calculation sub-module 703 is used to calculate the Euler function φ(n) of n.

The integer selection sub-module 704 is used to randomly select an integer e, where φ(n)>e>1, and e and φ(n) are relatively prime.

The modular inverse element calculation sub-module 705 is used to calculate the modular inverse element d of e to φ(n).

The encapsulation sub-module 706 is used to encapsulate n and e into image data public keys (n, e), and n and d into image data private keys (n, d).

The sending sub-module 707 is configured to send the image data public key (n, e) to the terminal that encrypts the plaintext of the encryption key.

Some embodiments of the application disclose a medical imaging information system. Please refer to FIG. 15, which is a block diagram of the basic structure of the medical imaging information system in an embodiment of the application.

As shown in FIG. 15, the medical imaging information system includes a cloud and at least one terminal communicatively connected to the cloud. The terminal includes at least one first memory 801 and at least one first processor 802. A first computer program is stored in the first memory 801, and the first computer program is implemented when executed by the first processor 802. A method for improving the security of image data transmission applied to the terminal. The terminal receives and sends data through the first network interface 803.

The cloud includes at least one second memory 804 and at least one second processor 805. A second computer program is stored in the second memory 804, and the second computer program is executed when the second processor 805 is executed. A method for improving the security of image data transmission applied to the cloud. The cloud receives and sends data through the second network interface 806.

It should be pointed out that FIG. 15 only shows the medical imaging information system with components 801-806, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead. . Those skilled in the art should understand that the cloud and terminal here can automatically perform numerical calculation and/or information processing equipment according to pre-set or stored instructions. The hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Programmable Gate Array (Field-Programmable Gate Array, FPGA), Digital Processor (Digital Signal Processor, DSP), embedded equipment, etc.

Both the first memory 801 and the second memory 804 include at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.) ), random access memory (RAM), static random access memory (SRAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), magnetic memory, magnetic disk , CD, etc. In some embodiments, both the first memory 801 and the second memory 804 may be internal storage units, such as the hard disk or memory. In other embodiments, both the first memory 801 and the second memory 804 may also be external storage devices, such as plug-in hard disks, Smart Media Card (SMC), and Secure Digital (Secure Digital). , SD) card, flash card (Flash Card), etc. Of course, the first memory 801 and the second memory 804 may both include an internal storage unit and an external storage device. In this embodiment, the first memory 801 and the second memory 804 are generally used to store operating systems and various application software. For example, the first memory 801 is used to store image data transmission enhancements applied to the terminal. The program code of the secure method, and the second memory 804 is used to store the program code of the method for improving the security of image data transmission applied to the cloud. In addition, both the first memory 801 and the second memory 804 can be used to temporarily store various types of data that have been output or will be output.

In some embodiments, the first processor 802 and the second processor 805 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. In this embodiment, the first processor 802 is configured to run the program code or process data stored in the first memory 801, for example, run the program code of the method for improving the security of image data transmission applied to the terminal. . The second processor 805 is configured to run the program code or process data stored in the second memory 804, for example, run the program code of the method for improving the security of image data transmission applied to the cloud.

An embodiment of the present application discloses a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned improved image data transmission applied to the terminal is realized A secure method or a method applied to the cloud to improve the security of image data transmission.

Finally, it should be noted that, obviously, the embodiments described above are only a part of the embodiments of this application, not all of them. The drawings show the preferred embodiments of this application, but do not limit the patents of this application. range. This application can be implemented in many different forms. On the contrary, the purpose of providing these examples is to make the understanding of the disclosure of this application more thorough and comprehensive. Although the application has been described in detail with reference to the foregoing embodiments, for those skilled in the art, it is still possible for those skilled in the art to modify the technical solutions described in the foregoing specific embodiments, or equivalently replace some of the technical features. . All equivalent structures made by using the contents of the description and drawings of this application, directly or indirectly used in other related technical fields, are similarly within the scope of patent protection of this application.

Claims (20)

1. A method for improving the security of image data transmission, applied to a terminal of a medical image information system, is characterized in that it includes:

   Select the first message of any length from the medical image data to generate the image data summary;

   Encrypting the image data digest with a digital authorized private key to obtain a digital signature;

   Encrypt the medical image data by a random key to obtain image encrypted data;

   The random key is encrypted by the image data public key to obtain an encryption key;

   The digital signature, the digital certificate, the image encryption data, and the encryption key are sent to the cloud of the medical image information system.
2. The method for improving the security of image data transmission according to claim 1, wherein the step of selecting a first message of any length from medical image data to generate an image data summary comprises:

   Pad the first message so that the result of the remainder of 512 for the byte length of the first message is equal to 448;

   Append a second message represented by a 64-bit binary number after the filled first message;

   Set 4 integer parameters of 32-bit link variables;

   The filled first message and the second message are respectively processed with 512 bits as a packet, and each of the packets is subjected to 4 rounds of transformation, with the 4 32-bit link variables as the starting variables Call 4 bit manipulation functions to calculate the first group;

   Output 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping;

   The 4 variables corresponding to the last group are used as the image data summary.
3. The method for improving the security of image data transmission according to claim 1, wherein the step of encrypting the random key with the image data public key to obtain an encryption key comprises:

   Encrypting the random key using the image data public key and an encryption formula ^me = c(mod n) to obtain the encryption key;

   c is the ciphertext of the encryption key, m is the plaintext of the encryption key obtained after decrypting the ciphertext of the encryption key, n is the product of two unequal prime numbers, e is an integer, φ (n)>e>1, and e and φ(n) are relatively prime, φ(n) refers to the Euler function of n, and (n, e) is the public key of the image data;

   When m≧n, the random key is encrypted in segments.
4. A method for improving the security of image data transmission, applied to the cloud of a medical image information system, is characterized in that it includes:

   Receive digital certificates, digital signatures, image encryption data and encryption keys;

   Verify the validity of the digital certificate;

   When it is verified that the digital certificate is valid, use the digital authorized public key in the digital authorized key pair to decrypt the digital signature to obtain an image data digest;

   When using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest, use the image data private key in the image data key pair to decrypt the encryption key To get a random key;

   When the image data private key in the image data key pair is used to decrypt the encryption key to obtain the random key, the random key is used to decrypt the image encrypted data to obtain the Medical imaging data;

   The image data abstract is compared with the medical image data; when the image data abstract is consistent with the corresponding part in the medical image data, it is confirmed that the medical image data passes the security verification.
5. The method for improving the security of image data transmission according to claim 4, wherein the step of verifying the validity of the digital certificate comprises:

   Verify the credibility of the certificate chain of the digital certificate;

   When the certificate chain of the digital certificate is trusted, verifying whether the digital certificate is revoked;

   When the digital certificate is not revoked, verifying whether the digital certificate is within the validity period;

   When the digital certificate is within the validity period, verify whether the domain name of the digital certificate matches the current access domain name;

   When the domain name of the digital certificate matches the current access domain name, it is confirmed that the digital certificate passes the validity verification.
6. The method for improving the security of image data transmission according to claim 4, wherein the step of comparing the image data summary with the medical image data comprises:

   Split the image data summary and import the first data list;

   Splitting the part of the medical image data used to generate the image data summary and importing the second data list;

   The first data list and the second data list are compared to determine whether the first data list and the second data list are consistent.
7. A device for improving the security of image data transmission, applied to a terminal of a medical image information system, characterized in that it includes:

   The image data summary generating module is used to select the first message of any length from the medical image data to generate the image data summary;

   A digital signature generating module, which is used to encrypt the image data digest with a digital authorized private key to obtain a digital signature;

   An image encryption data generation module, used for encrypting the medical image data by a random key to obtain image encryption data;

   Encryption key generation module, used for encrypting the random key by the image data public key to obtain an encryption key;

   The sending module is used to send the digital signature, the digital certificate, the image encryption data, and the encryption key to the cloud of the medical image information system.
8. The device for improving the security of image data transmission according to claim 7, wherein the image data summary generating module further comprises:

   The first packet filling submodule is used to fill the first packet so that the result of the remainder of 512 for the byte length of the first packet is equal to 448;

   The second message appending submodule is used to append a second message represented by a 64-bit binary number after the filled first message;

   Integer parameter setting sub-module, used to set the integer parameters of 4 32-bit link variables;

   The packet processing sub-module is used to process the filled first packet and the second packet with 512 bits as a packet, and each packet is subjected to 4 rounds of transformation, using the 4 32 The bit link variable is the starting variable and calls 4 bit manipulation functions to calculate the first group;

   The image data summary output sub-module is used to output 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping.
9. The device for improving the security of image data transmission according to claim 7, wherein the encryption key generation module uses the image data public key and the encryption formula ^me = c(mod n) to compare the random key Encryption is performed to obtain the encryption key; c is the cipher text of the encryption key, m is the plain text of the encryption key obtained after decrypting the cipher text of the encryption key, and n is two unequal The product of prime numbers p and q, e is an integer, φ(n)>e>1, and e and φ(n) are relatively prime, φ(n) refers to the Euler function of n, and (n, e) is the result The image data public key; when m≧n, the random key is encrypted in sections.
10. A device for improving the security of image data transmission, applied to the cloud of a medical image information system, is characterized in that it includes:

    The receiving module is used to receive digital certificates, digital signatures, image encryption data and encryption keys;

    The digital certificate verification module is used to verify the validity of the digital certificate;

    The digital certificate decryption module is used to decrypt the digital signature by using the digital authorization public key in the digital authorization key pair to obtain the image data digest when the digital certificate is verified to be valid;

    The encryption key decryption module is configured to use the image data in the image data key pair to privately use the image data in the image data key pair when using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest. Key to decrypt the encryption key to obtain a random key;

    The image encryption data decryption module is configured to use the random key for the image when the image data private key in the image data key pair is used to decrypt the encryption key to obtain the random key. Decrypt the encrypted data to obtain the medical image data;

    The image data summary comparison module is used to compare the image data summary with the medical image data; when the image data summary is consistent with the corresponding part in the medical image data, confirm the medical image The data passes security verification.
11. The device for improving the security of image data transmission according to claim 10, wherein the digital certificate verification module further comprises:

    The certificate chain verification sub-module is used to verify the credibility of the certificate chain of the digital certificate;

    The revocation verification sub-module is used to verify whether the digital certificate is revoked when the certificate chain of the digital certificate is trusted;

    The validity period verification submodule is used to verify whether the digital certificate is within the validity period when the digital certificate is not revoked;

    The domain name verification sub-module is used to verify whether the domain name of the digital certificate matches the current access domain name when the digital certificate is within the validity period, and when the domain name of the digital certificate matches the current access domain name To confirm that the digital certificate passes the validity verification.
12. The device for improving the security of image data transmission according to claim 10, wherein the image data summary comparison module further comprises:

    The first data list submodule is used to split the image data summary and import the first data list;

    The second data list submodule is used to split the part of the medical image data used to generate the image data summary and import the second data list;

    The data list comparison sub-module is configured to compare the first data list and the second data list to determine whether the first data list and the second data list are consistent.
13. The device for improving the security of image data transmission according to claim 10, wherein the device further comprises an image data key pair generation module for generating the image data key pair, the image data key pair Including image data private key and image data public key.
14. The device for improving the security of image data transmission according to claim 13, wherein the image data key pair generation module further comprises:

    Prime number selection submodule, used to randomly select two unequal prime numbers p and q;

    Prime number product calculation sub-module, used to calculate the product n of p and q;

    Euler function calculation sub-module, used to calculate the Euler function φ(n) of n;

    Integer selection submodule, used to randomly select an integer e, where φ(n)>e>1, and e and φ(n) are relatively prime;

    The modular inverse element calculation sub-module is used to calculate the modular inverse element d of e to φ(n);

    Encapsulation sub-module for encapsulating n and e into image data public keys (n, e), and n and d into image data private keys (n, d);

    The sending sub-module is used to send the image data public key (n, e) to the terminal that encrypts the plain text of the encryption key.
15. A medical imaging information system, characterized by comprising a cloud and at least one terminal communicatively connected with the cloud;

    The terminal includes at least one first memory and at least one first processor, the first memory stores a first computer program, and when the first computer program is executed by the first processor, the following steps are implemented:

    Select the first message of any length from the medical image data to generate the image data summary;

    Encrypting the image data digest with a digital authorized private key to obtain a digital signature;

    Encrypt the medical image data by a random key to obtain image encrypted data;

    The random key is encrypted by the image data public key to obtain an encryption key;

    Sending the digital signature, the digital certificate, the image encryption data, and the encryption key to the cloud of the medical image information system;

    The cloud includes at least one second memory and at least one second processor, and a second computer program is stored in the second memory. When the second computer program is executed by the second processor, the following steps are implemented:

    Receive digital certificates, digital signatures, image encryption data and encryption keys;

    Verify the validity of the digital certificate;

    When it is verified that the digital certificate is valid, use the digital authorized public key in the digital authorized key pair to decrypt the digital signature to obtain an image data digest;

    When using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest, use the image data private key in the image data key pair to decrypt the encryption key To get a random key;

    When the image data private key in the image data key pair is used to decrypt the encryption key to obtain the random key, the random key is used to decrypt the image encrypted data to obtain the Medical imaging data;

    The image data abstract is compared with the medical image data; when the image data abstract is consistent with the corresponding part in the medical image data, it is confirmed that the medical image data passes the security verification.
16. The medical imaging information system according to claim 15, wherein the following steps can be further implemented when the first computer program is executed by the first processor:

    Pad the first message so that the result of the remainder of 512 for the byte length of the first message is equal to 448;

    Append a second message represented by a 64-bit binary number after the filled first message;

    Set 4 integer parameters of 32-bit link variables;

    The filled first message and the second message are respectively processed with 512 bits as a packet, and each of the packets is subjected to 4 rounds of transformation, with the 4 32-bit link variables as the starting variables Call 4 bit manipulation functions to calculate the first group;

    Output 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping;

    The 4 variables corresponding to the last group are used as the image data summary.
17. The medical imaging information system according to claim 15, wherein the second computer program further implements the following steps when being executed by the second processor:

    Verify the credibility of the certificate chain of the digital certificate;

    When the certificate chain of the digital certificate is trusted, verifying whether the digital certificate is revoked;

    When the digital certificate is not revoked, verifying whether the digital certificate is within the validity period;

    When the digital certificate is within the validity period, verify whether the domain name of the digital certificate matches the current access domain name;

    When the domain name of the digital certificate matches the current access domain name, it is confirmed that the digital certificate passes the validity verification.
18. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

    Select the first message of any length from the medical image data to generate the image data summary;

    Encrypting the image data digest with a digital authorized private key to obtain a digital signature;

    Encrypt the medical image data by a random key to obtain image encrypted data;

    The random key is encrypted by the image data public key to obtain an encryption key;

    The digital signature, the digital certificate, the image encryption data, and the encryption key are sent to the cloud of the medical image information system.
19. The computer-readable storage medium according to claim 18, wherein the computer program further implements the following steps when being executed by a processor:

    Pad the first message so that the result of the remainder of 512 for the byte length of the first message is equal to 448;

    Append a second message represented by a 64-bit binary number after the filled first message;

    Set 4 integer parameters of 32-bit link variables;

    The filled first message and the second message are respectively processed with 512 bits as a packet, and each of the packets is subjected to 4 rounds of transformation, with the 4 32-bit link variables as the starting variables Call 4 bit manipulation functions to calculate the first group;

    Output 4 variables calculated by the 4 bit manipulation functions, and use the 4 variables to perform the next grouping operation until the last grouping;

    The 4 variables corresponding to the last group are used as the image data summary.
20. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

    Receive digital certificates, digital signatures, image encryption data and encryption keys;

    Verify the validity of the digital certificate;

    When it is verified that the digital certificate is valid, use the digital authorized public key in the digital authorized key pair to decrypt the digital signature to obtain an image data digest;

    When using the digital authorization public key in the digital authorization key pair to decrypt the digital signature to obtain the image data digest, use the image data private key in the image data key pair to decrypt the encryption key To get a random key;

    When the image data private key in the image data key pair is used to decrypt the encryption key to obtain the random key, the random key is used to decrypt the image encrypted data to obtain the Medical imaging data;

    The image data abstract is compared with the medical image data; when the image data abstract is consistent with the corresponding part in the medical image data, it is confirmed that the medical image data passes the security verification.

Images