Dynamic data desensitization method, device, equipment, medium and program product

Abstract

The invention provides a dynamic data desensitization method which can be applied to the field of privacy computing and the field of financial science and technology. The method comprises the steps of obtaining original data in response to a data access request of a user, and performing sensitive field identification on the original data through a natural language processing model to obtain a sensitive field and a sensitive field type; collecting user access information in real time, analyzing the user access information through a context scoring model, and generating a current desensitization intensity grade; dynamically selecting a desensitization strategy based on the sensitive field type and the current desensitization intensity grade, determining a target desensitization strategy, and processing the sensitive field through the target desensitization strategy to obtain first desensitization data; performing irreversible desensitization processing on the first desensitization data to generate second desensitization data; and determining first request data based on the original data and the second desensitized data, and returning the first request data to the user. The invention further provides a dynamic data desensitization device and equipment, a storage medium and a program product.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy computing, and also relates to the field of financial technology, and more particularly to a dynamic data desensitization method, device, equipment, medium and program product. BACKGROUND

[0002] In the financial field, data desensitization is the core defense line for protecting customer privacy and fund safety. Financial institutions store a large amount of sensitive information, including account details, identity card numbers, transaction records, etc. Through desensitization processing, data usability can be retained in data analysis, system testing, third-party cooperation, etc. scenes, and sensitive information leakage can be prevented. Through data desensitization, a financial data security barrier can be built, which is a key link for preventing systemic risk and ensuring the stability of the financial market.

[0003] Existing data desensitization technologies usually use static rules and unified formats to process sensitive data, and are widely used in data warehouses, business platforms and information exchange scenarios. However, these solutions often achieve data desensitization through simple field truncation, masking (such as retaining the last four digits of an ID number) or hash mapping, etc. Therefore, these traditional data desensitization methods do not have dynamic adjustment capabilities and rely on deterministic rules, which are easy to be cracked and lack security. SUMMARY

[0004] In view of the above problems, the present application provides a dynamic data desensitization method, device, equipment, medium and program product for improving data security.

[0005] According to a first aspect of the present application, a dynamic data desensitization method is provided, comprising: in response to a user's data access request, obtaining original data corresponding to the data access request, and identifying sensitive fields and sensitive field types through a natural language processing model on the original data; collecting user access information corresponding to the data access request in real time, and analyzing the user access information through a context scoring model to generate a current desensitization strength level; dynamically selecting a desensitization strategy based on the sensitive field type and the current desensitization strength level, determining a target desensitization strategy, and processing the sensitive field through the target desensitization strategy to obtain first desensitized data; performing irreversible desensitization processing on the first desensitized data to generate second desensitized data; and determining first request data based on the original data and the second desensitized data, and returning the first request data to the user.

[0006] According to an embodiment of the present application, the sensitive field type includes a field-level label and a semantic-level label; the dynamic selection of the de-sensitization strategy based on the sensitive field type and the current de-sensitization intensity level determines a target de-sensitization strategy, including: determining a field-level strategy according to the field-level label; determining a semantic-level strategy according to the semantic-level label; and determining the target de-sensitization strategy through a dynamic de-sensitization strategy engine according to the field-level label, the semantic-level label, and the current de-sensitization intensity level; wherein the target de-sensitization strategy includes one or more of the field-level strategy, the semantic-level strategy, and a field-semantic superposition strategy; and the field-semantic superposition strategy includes the field-level strategy and the semantic-level strategy.

[0007] According to an embodiment of the present application, the target de-sensitization strategy is executed in a priority mechanism; wherein the priority mechanism includes: the priority of the field-level strategy is higher than the priority of the semantic-level strategy; and in the case that the current de-sensitization intensity level is high, the de-sensitization processing result of the semantic-level strategy is covered for secondary processing based on the field-level strategy.

[0008] According to an embodiment of the present application, the determination of the target de-sensitization strategy through the dynamic de-sensitization strategy engine according to the field-level label, the semantic-level label, and the current de-sensitization intensity level includes: determining a current strategy combination according to the field-level label, the semantic-level label, and the current de-sensitization intensity level based on a rule matrix; and determining the target de-sensitization strategy based on the current strategy combination and a current de-sensitization intensity rule; wherein the mapping rule of the rule matrix includes: selecting the field-level strategy or the semantic-level strategy based on a single-strategy trigger condition; selecting the field-semantic superposition strategy based on a superposition strategy trigger condition; and determining the current de-sensitization intensity rule according to the current de-sensitization intensity level.

[0009] According to an embodiment of the present application, the irreversible de-sensitization processing of the first de-sensitization data to generate second de-sensitization data includes: simulating quantum measurement disturbance characteristics based on a quantum noise disturbance mechanism to generate simulated quantum noise; and disturbing processing the first de-sensitization data based on the simulated quantum noise to generate the second de-sensitization data.

[0010] According to an embodiment of the present application, the analyzing the user access information by the context scoring model to generate the current desensitization strength level comprises: obtaining a context factor of the user access information; numerically quantifying the context factor to determine a factor score corresponding to the context factor; weighting the factor score corresponding to the context factor based on a first weight corresponding to the context factor to obtain a risk level score; weighting the risk level score and the context factor according to a second weight corresponding to the context factor to obtain a desensitization strength score, wherein the second weight is determined based on the first weight; and determining the current desensitization strength level by grade mapping based on the desensitization strength score.

[0011] According to an embodiment of the present application, the determining the second weight based on the first weight comprises: statistically analyzing historical risk events to determine the first weight corresponding to the context factor; and adjusting the first weight corresponding to the context factor by optimizing an adjustment strategy to determine the second weight corresponding to the context factor.

[0012] According to an embodiment of the present application, the context factor comprises one or more of a user role, a device fingerprint, a geographic location, and an access time; the numerically quantifying the context factor to determine the factor score corresponding to the context factor comprises: determining a factor score corresponding to the user role based on a user permission level corresponding to the user role; determining a factor score corresponding to the device fingerprint based on a device trustworthiness corresponding to the device fingerprint; determining a factor score corresponding to the geographic location based on an Internet protocol address corresponding to the geographic location; and determining a factor score corresponding to the access time based on an access time period corresponding to the access time.

[0013] According to an embodiment of the present application, the method further comprises: determining an access permission according to the user permission level; determining an environment security degree according to the device trustworthiness, the Internet protocol address, and the access time period; determining a risk degree according to the current desensitization strength level; and in a case where the access permission, the environment security degree, and the risk degree all satisfy a safe review condition, determining second request data based on the original data and returning the second request data to the user.

[0014] The second aspect of the present application provides a dynamic data desensitization device, comprising: a natural language processing module, configured to obtain original data corresponding to a data access request of a user in response to the data access request, and perform sensitive field identification on the original data through a natural language processing model to obtain a sensitive field and a sensitive field type; a context analysis module, configured to collect user access information corresponding to the data access request in real time, and analyze the user access information through a context scoring model to generate a current desensitization intensity level; a first desensitization module, configured to dynamically select a desensitization strategy based on the sensitive field type and the current desensitization intensity level, determine a target desensitization strategy, and process the sensitive field through the target desensitization strategy to obtain first desensitization data; a second desensitization module, configured to perform irreversible desensitization processing on the first desensitization data to generate second desensitization data; and a desensitization data return module, configured to determine first request data based on the original data and the second desensitization data, and return the first request data to the user.

[0015] According to an embodiment of the present application, the sensitive field type includes a field-level label and a semantic-level label; the first desensitization module comprises: a field strategy unit configured to determine a field-level strategy according to the field-level label; a semantic strategy unit configured to determine a semantic-level strategy according to the semantic-level label; and a dynamic engine unit configured to determine the target desensitization strategy through a dynamic desensitization strategy engine according to the field-level label, the semantic-level label, and the current desensitization intensity level; wherein the target desensitization strategy includes one or more of the field-level strategy, the semantic-level strategy, and a field-semantic superposition strategy; and the field-semantic superposition strategy includes the field-level strategy and the semantic-level strategy.

[0016] According to an embodiment of the present application, the dynamic engine unit is further configured to perform the target desensitization strategy in a priority mechanism; wherein the priority mechanism includes: a priority of the field-level strategy is higher than a priority of the semantic-level strategy; and in a case where the current desensitization intensity level is high, performing secondary processing based on a desensitization processing result of the semantic-level strategy.

[0017] According to an embodiment of the present application, the dynamic engine unit comprises: a policy combination subunit configured to determine a current policy combination based on a rule matrix according to the field-level label, the semantic-level label, and the current de-sensitization intensity level; and a target policy subunit configured to determine the target de-sensitization policy based on the current policy combination and a current de-sensitization intensity rule; wherein the mapping rule of the rule matrix comprises: selecting the field-level policy or the semantic-level policy based on a single-policy trigger condition; selecting the field-semantic superimposed policy based on a superimposed policy trigger condition; and determining the current de-sensitization intensity rule according to the current de-sensitization intensity level.

[0018] According to an embodiment of the present application, the second de-sensitization module comprises: a quantum simulation unit configured to simulate quantum measurement disturbance characteristics based on a quantum noise disturbance mechanism to generate simulated quantum noise; and a data disturbance unit configured to disturb the first de-sensitization data based on the simulated quantum noise to generate the second de-sensitization data.

[0019] According to an embodiment of the present application, the context analysis module comprises: an acquisition unit configured to acquire a context factor of the user access information; a quantization unit configured to quantize the context factor to determine a factor score corresponding to the context factor; a risk level score unit configured to weight the factor score corresponding to the context factor based on a first weight corresponding to the context factor to obtain a risk level score; a de-sensitization intensity score unit configured to weight process the risk level score and the context factor based on a second weight corresponding to the context factor to obtain a de-sensitization intensity score; wherein the second weight is determined based on the first weight; and an intensity rating unit configured to map the de-sensitization intensity score to a level to determine the current de-sensitization intensity level.

[0020] According to an embodiment of the present application, the context analysis module further comprises: a factor weight determination unit configured to statistically analyze historical risk events to determine the first weight corresponding to the context factor; and adjust the first weight corresponding to the context factor by optimizing an adjustment policy to determine the second weight corresponding to the context factor.

[0021] According to an embodiment of the present application, the context factors include one or more of a user role, a device fingerprint, a geographic location, and an access time; and the quantifying unit includes: a first quantifying sub-unit configured to determine a factor score corresponding to the user role based on a user permission level corresponding to the user role; a second quantifying sub-unit configured to determine a factor score corresponding to the device fingerprint based on a device trustworthiness corresponding to the device fingerprint; a third quantifying sub-unit configured to determine a factor score corresponding to the geographic location based on an Internet Protocol address corresponding to the geographic location; and a fourth quantifying sub-unit configured to determine a factor score corresponding to the access time based on an access time period corresponding to the access time.

[0022] According to an embodiment of the present application, the device further includes a normal data returning module configured to: determine an access permission based on the user permission level; determine an environment security degree based on the device trustworthiness, the Internet Protocol address, and the access time period; determine a risk degree based on the current desensitization intensity level; and determine second request data based on the original data and return the second request data to the user if the access permission, the environment security degree, and the risk degree all satisfy a safe review condition.

[0023] A third aspect of the present application provides an electronic device, including: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0024] A fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0025] A fifth aspect of the present application further provides a computer program product including a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0026] In the embodiments of the present application, the sensitive data, i.e., sensitive fields and sensitive field types, are identified in combination with the natural language processing technology, the current desensitization intensity level is determined by analyzing the context score of the user access information, the desensitization strategy is dynamically selected, the sensitive data is processed in combination with the irreversible desensitization, the dynamic data desensitization is completed, the intelligent identification of the sensitive data in the original data of the data access request, the context dynamic response, and the high-intensity protection are realized, the data security is improved, and the data availability and intelligence are taken into account. BRIEF DESCRIPTION OF DRAWINGS

[0027] The above content of the present application and other purposes, features and advantages will be more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0028] Figure 1 An application scenario diagram of the dynamic data desensitization method, device, equipment, medium and program product according to the embodiments of the present application is schematically shown;

[0029] Figure 2 A flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0030] Figure 3 A field semantic superposition desensitization strategy diagram of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0031] Figure 4 A context scoring model processing flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0032] Figure 5 A dynamically selected desensitization strategy flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0033] Figure 6 A quantum perturbation flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0034] Figure 7 Another flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown;

[0035] Figure 8 A structural block diagram of the dynamic data desensitization device according to the embodiments of the present application is schematically shown; and

[0036] Figure 9 A block diagram of an electronic device suitable for implementing the dynamic data desensitization method according to the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0037] Hereinafter, the embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary, and are not intended to limit the scope of the present application. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to one skilled in the art that one or more embodiments can be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques have been omitted to avoid unnecessarily obscuring the concept of the present application.

[0038] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used herein, the terms "comprises", "comprising", "includes", "including" and the like are specifically intended to be open-ended and to mean that other features, steps, operations, and / or components can be added.

[0039] All terms used herein including technical and scientific terms have the meanings commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein are defined as having a meaning that is consistent with the context of the specification in which the terms are utilized and the terms should not be interpreted in an idealized or overly formal sense.

[0040] In situations where similar terminology is used for similar items, but not all items are in common, it is to be understood that, such terminology is to be interpreted in the manner which is most consistent with the context of the specific circumstances described including the specific examples or drawings discussed.

[0041] First, the technical terms described herein are explained and described as follows.

[0042] Sensitive data: refers to fields or text segments containing identifiable personal identity, financial information, transaction behavior, geographic track, and authentication credentials, etc. If leaked, it will affect the privacy of the subject or the security of the system.

[0043] Desensitization: transformation, masking or substitution of sensitive data so that it loses the ability to identify the subject or restore the original value without affecting business use.

[0044] Field-level desensitization: partial truncation, masking or substitution of structured fields such as ID card number, mobile phone number, and bank card number.

[0045] Semantic-level desensitization: based on contextual semantic understanding, the text description information (such as "wage transfer") is fuzzily rewritten as "account transfer" to reduce the risk of sensitive expression.

[0046] Natural language processing model (NLP model): through pre-training to learn text semantic features, combining rule matching and deep learning algorithms, automatically identifying sensitive field information (such as name, ID card number, etc.) in data, and outputting field type labels according to classification.

[0047] Context awareness: through the collection of user identity, device information, geographic location, time characteristics and other environmental variables at the time of access, the current operation is determined and dynamically responded.

[0048] Context scoring model: According to the user behavior environment scoring model, the risk level score and the desensitization intensity level of the current operation are calculated to guide the desensitization strategy scheduling.

[0049] Desensitization intensity level: The protection level is determined according to the context score (risk level score), which is usually divided into three levels of low, medium and high, and can correspond to different desensitization strategy combinations.

[0050] Dynamic desensitization strategy engine: A dynamic analysis field type and desensitization intensity level is called to match the field-level or semantic-level desensitization rule set for desensitization execution control module.

[0051] Irreversible desensitization: The processed data cannot be pushed back to the original value through reverse rules, machine learning or brute force inference, which is the ultimate protection means to ensure privacy security.

[0052] Quantum noise disturbance mechanism: Quantum noise disturbance algorithm, simulating the principle of quantum measurement disturbance, through a high-intensity unpredictable pseudo-random sequence to disturb the desensitized data again, making it irreversible.

[0053] Existing data desensitization technology relies on static rules and unified formats to process sensitive data, but these data desensitization methods often have drawbacks: (1) The desensitization strategy is single, and lacks the ability to perceive the operation subject and context, and cannot dynamically adjust the desensitization strategy according to the user's role and behavior environment; (2) Insufficient identification of sensitive information, in complex semantic scenarios, existing methods cannot effectively identify "implicit" sensitive information, such as implicit personal / business features in transaction descriptions or operation instructions; (3) Low security, traditional methods rely on reversible algorithms (such as hash algorithms), which have the risk of being reversed.

[0054] Therefore, the embodiments of the present application provide a dynamic data desensitization method, in response to a user's data access request, obtaining the original data corresponding to the data access request, and identifying the sensitive fields and sensitive field types through a natural language processing model on the original data; Real-time collection of user access information corresponding to the data access request, and analysis of the user access information through a context scoring model to generate the current desensitization intensity level; Based on the sensitive field type and the current desensitization intensity level, dynamically select a desensitization strategy, determine a target desensitization strategy, and process the sensitive field through the target desensitization strategy to obtain first desensitized data; The first desensitized data is irreversibly desensitized to generate second desensitized data; and determining the first request data based on the original data and the second desensitized data, and returning the first request data to the user.

[0055] In the embodiments of the present application, sensitive data, i.e., sensitive fields and sensitive field types, are identified in combination with natural language processing technology, a current desensitization intensity level is determined by analyzing a context score of user access information, a desensitization strategy is dynamically selected, sensitive data is processed in combination with irreversible desensitization, dynamic data desensitization is completed, intelligent identification of sensitive data in original data of a data access request, context dynamic response, and high-intensity protection are realized, the data security is improved, and data usability and intelligence are taken into account.

[0056] Figure 1 An application scenario diagram of the dynamic data desensitization method, apparatus, device, medium, and program product according to the embodiments of the present application is schematically shown.

[0057] As Figure 1 shown, the application scenario 100 according to the embodiments can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or optical fiber cables, and the like.

[0058] A user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, and the like. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, and the like (only as examples).

[0059] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0060] The server 105 can be a server providing various services, such as a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and the like, and feed back processing results (such as web pages, information, or data, and the like obtained or generated according to user requests) to the terminal device.

[0061] It should be noted that the dynamic data desensitization method provided in the embodiments of the present application can be executed by the server 105. Correspondingly, the dynamic data desensitization apparatus provided in the embodiments of the present application can be arranged in the server 105. The dynamic data desensitization method provided in the embodiments of the present application can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the dynamic data desensitization apparatus provided in the embodiments of the present application can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0062] It should be noted that the dynamic data desensitization method and apparatus of the present application can be used in the field of privacy computing and the field of financial technology, and can also be used in any field other than the field of privacy computing and the field of financial technology. The application field of the dynamic data desensitization method and apparatus of the present application is not limited.

[0063] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above-mentioned scenarios is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks and servers.

[0064] The dynamic data desensitization method according to the embodiments of the present application will be described in detail below based on the scenarios described above. Figure 1 Figures 2-7 The dynamic data desensitization method according to the embodiments of the present application will be described in detail below based on the scenarios described above.

[0065] Figure 2 The flowchart of the dynamic data desensitization method according to the embodiments of the present application is schematically shown.

[0066] As shown in Figure 2 The dynamic data desensitization method of this embodiment includes operations S210-S250, and the dynamic data desensitization method is not limited to a specific execution subject. The execution subject can be any electronic device, such as a terminal device or a server device, etc. The execution subject can also be any software application, system or client. For the convenience of unified description, the corresponding example is taken with the system as the execution subject, for example, the user can initiate a data access request from the front-end system, and the system executes the dynamic data desensitization method of the present application.

[0067] In operation S210, in response to a data access request of a user, the original data corresponding to the data access request is obtained, and the original data is subjected to sensitive field identification through a natural language processing model to obtain a sensitive field and a sensitive field type.

[0068] ​The user can initiate a data access request to the system through a Web interface, an API interface, or an intermediate service layer. The system obtains corresponding raw data according to the data access request. The raw data first enters the data access layer, is formatted and metadata is extracted, to ensure that the field structure is clear for subsequent model analysis and processing.

[0069] The natural language processing model is an NLP model constructed in combination with a Bidirectional Encoder Representations from Transformers (BERT) model, a Bi-directional Long Short-Term Memory (BiLSTM) model, and a Conditional Random Fields (CRF) model. The NLP model based on the BERT-BiLSTM-CRF hybrid architecture extracts structured information from a large amount of text and performs field-by-field semantic analysis on structured and unstructured data. The model can identify sensitive fields such as identity information (such as an ID card and a mobile phone number), financial information (such as a bank card number and a transaction amount), and behavior descriptions (such as transaction content). The type of the output sensitive field is marked by a field label, which includes a field-level label (such as an ID card number and a mobile phone number) and a semantic-level label (such as a salary description and a transaction content).

[0070] The BERT model is a pre-trained language model that learns context information and captures deep semantic representations of text, i.e., text vectors. The BiLSTM model is a bidirectional recurrent neural network that performs sequence modeling on the vectors output by the BERT model. By considering past and future context information simultaneously, the BiLSTM model captures time sequence features in the sequence. The CRF model considers the transition constraints between labels based on the label probability output by the BiLSTM model and outputs a globally optimal label sequence.

[0071] In operation S220, user access information corresponding to the data access request is collected in real time, and the user access information is analyzed by a context scoring model to generate a current desensitization intensity level.

[0072] Real-time collection of user access information, including but not limited to role identification (such as business personnel, auditors), terminal device fingerprint (such as network device physical address (Media Access Control Address, MAC address) and browser type), device logical address in the network (Internet Protocol Address, IP address), geographic location, access time and behavior pattern. A multi-factor context scoring model is used to analyze user access information, assign a risk level to the current access environment, and generate a desensitization strength level (desensitization strength score S∈{low, medium, high}) based on this, which will affect the strength of the desensitization strategy.

[0073] In an embodiment of the present application, the user's consent or authorization can be obtained before obtaining the user access information. For example, a request for obtaining user access information can be issued to the user before operation S220. In the case where the user agrees or authorizes the user access information to be obtained, operation S220 is performed.

[0074] In the technical solution of the present application, the user information (including but not limited to user personal information, user access information, user device information, such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0075] In operation S230, a desensitization strategy is dynamically selected based on the sensitive field type and the current desensitization strength level, a target desensitization strategy is determined, and the sensitive field is processed through the target desensitization strategy to obtain first desensitized data.

[0076] According to the sensitive field type and the desensitization strength level, a desensitization strategy is dynamically selected, which can select a field-level (such as masking, truncation) or semantic-level (such as word meaning ambiguity, sentence rewriting) desensitization strategy through a dynamic desensitization strategy engine. The target strategy is a combination of desensitization strategies for processing the content of the sensitive field in the original data, and the combination of desensitization strategies supports rule inheritance (such as supporting multiple levels of masking or replacement rules for the same field under different strategies), priority configuration and strategy rollback. The first desensitized data represents desensitized data after the sensitive field data is processed by the target desensitization strategy.

[0077] According to an embodiment of the present application, the target desensitization strategy is executed in cascade according to a priority mechanism; wherein the priority mechanism comprises: the priority of the field-level strategy is higher than the priority of the semantic-level strategy; and in the case that the current desensitization intensity level is high, the desensitization processing result of the semantic-level strategy is covered for secondary processing based on the field-level strategy.

[0078] Exemplarily, Figure 3 A field semantic superposition desensitization strategy diagram of a dynamic data desensitization method according to an embodiment of the present application is schematically shown, Figure 3 As shown, the priority of the field-level strategy is higher than the priority of the semantic-level strategy, and then the field-level desensitization processing is performed first. In a conventional scene flow, the original data is first subjected to field-level desensitization (masking / truncation of structured data, ensuring that the underlying sensitive information is hidden), and then the field-level desensitization data can be output by field masking, and then semantic-level desensitization (semantic rewriting of text content, eliminating context-sensitive information) is performed, and then the desensitized data can be output by fuzzy description, and finally the desensitized data can be subjected to quantum noise disturbance (through irreversible disturbance to reinforce data security), and the desensitized result is output.

[0079] In a dynamic adjustment scene, when the desensitization intensity level is high, an additional step (such as secondary field-level desensitization) can be inserted to form a chain processing, for example, first field-level desensitization, second semantic-level desensitization, third secondary field-level disturbance, and finally quantum noise disturbance, and the desensitized result is output.

[0080] In an embodiment of the present application, the desensitization strategy is executed in cascade according to a priority, so that the strategy presents a chain triggering characteristic, the priority of the field-level strategy is higher than the priority of the semantic-level strategy, the underlying data is desensitized first, dynamic decision is realized, and when a high-level desensitization intensity occurs, an additional secondary field-level desensitization is inserted to enhance the desensitization intensity and improve the security of the data.

[0081] In operation S240, irreversible desensitization processing is performed on the first desensitized data to generate second desensitized data.

[0082] The data after the irreversible desensitization processing cannot be pushed back to the original value through reverse rules, machine learning or brute force inference, and can be realized through irreversible encryption, quantum noise disturbance and other algorithms. The second desensitized data represents the desensitized data of the first desensitized data after the irreversible desensitization processing.

[0083] In operation S250, the first request data is determined based on the original data and the second desensitized data, and the first request data is returned to the user.

[0084] The data of the sensitive field in the original data is replaced by the second desensitization data to generate first request data, and the desensitized first request data is output to the calling party, and the audit information such as the context snapshot, the identification of the target strategy, and the scoring log is recorded synchronously, so that compliance tracking and strategy optimization are supported. The desensitization method of the application can not only automatically identify and process sensitive fields, but also fully utilize the access context to intelligently match the desensitization strategy, and add anti-reverse protection measures before the data leaves the system, thereby comprehensively guaranteeing the compliance and security of data use. The system can be modularly designed to support micro-service deployment, facilitating integration into existing business systems, and being suitable for various industry scenarios such as finance, medical treatment, and the Internet with strict supervision, and having high application promotion value.

[0085] In the embodiment of the application, the sensitive data, i.e., the sensitive field and the sensitive field type, is identified in combination with the natural language processing technology, the current desensitization intensity level is determined by analyzing the context score of the user access information, the desensitization strategy is dynamically selected, and the sensitive data is processed in combination with the irreversible desensitization, so as to complete dynamic data desensitization, realize intelligent identification of sensitive data in the original data of the data access request, dynamic response of the context, and high-intensity protection, and the data security is improved, and the data availability and intelligence are taken into account.

[0086] Figure 4 A context scoring model processing flowchart of the dynamic data desensitization method according to the embodiment of the application is schematically shown.

[0087] As shown in Figure 4 Operation S220, the user access information is analyzed by the context scoring model to generate the current desensitization intensity level, which includes operation S410~operation S450.

[0088] In operation S410, the context factors of the user access information are obtained.

[0089] The context factors include user roles U, device fingerprints D, geographic locations G, and access times T. The user roles are, for example, business personnel, auditors, administrators, etc., the device fingerprints are, for example, MAC addresses, IP addresses, etc., the geographic locations are, for example, actual physical locations, etc., and the access times are, for example, specific time instants when the access request is initiated.

[0090] In operation S420, the context factors are numerically quantified to determine the factor scores corresponding to the context factors.

[0091] According to the embodiment of the application, in operation S420, the context factors are numerically quantified to determine the factor scores corresponding to the context factors, which includes operation S4201~operation S4204.

[0092] In operation S4201, based on the user permission level corresponding to the user role, the factor score corresponding to the user role is determined.

[0093] According to the role permission, a value is given, such as an administrator: U=0.1, a normal user: U=0.5, and an external user: U=0.8.

[0094] In operation S4202, a factor score corresponding to the device fingerprint is determined based on device credibility corresponding to the device fingerprint.

[0095] The device credibility is evaluated to determine the factor score corresponding to the device fingerprint, reflecting the security of the terminal device, such as a trusted device (such as a company-issued device): D=0.2; a normal device (a regular browser / unsurpassed mobile phone): D=0.5; and a high-risk device (an unsurpassed device / emulator): D=0.8.

[0096] In operation S4203, a factor score corresponding to the geographic location is determined based on an Internet protocol address corresponding to the geographic location.

[0097] Based on the Internet protocol address (Internet Protocol Address, IP address), the credibility of the access location is determined, and it is determined whether the IP address is compliant, such as a trusted location (company intranet / white list IP segment): G=0.1; a normal location (commonly used IP in the territory): G=0.4; and a high-risk location (overseas / blacklist IP): G=0.7.

[0098] In operation S4204, a factor score corresponding to the access time is determined based on an access time period corresponding to the access time.

[0099] It is detected whether the access time is an abnormal time period, and the risk is evaluated according to the reasonableness of the access time, such as normal time (workday 9:00-18:00): T=0.1; marginal time (non-working hours but reasonable): T=0.4; and abnormal time (early morning / high-frequency access): T=0.8.

[0100] In an embodiment of the present application, the influence factors of user roles, device fingerprints, geographic locations, and access times are quantitatively evaluated to facilitate determination of the desensitization strength level and timely adjustment of the target desensitization strategy.

[0101] In operation S430, the factor score corresponding to the context factor is weighted based on the first weight corresponding to the context factor to obtain a risk level score.

[0102] The risk level score R is a key indicator for quantifying the overall security of the current access environment. The risk level score R is formed by integrating factors such as user role credibility, device risk, and geographical location abnormality, to form a unified risk quantification result, and provides a basis for calculating the desensitization intensity level. The risk level score R directly affects the final desensitization strategy as a core factor of the desensitization intensity level. A high R value may trigger a more stringent desensitization strategy (such as full-field masking + semantic fuzzing). For example, when R = high, S = high, multiple desensitization rules may be superimposed.

[0103] Each context factor (such as user role, device fingerprint, etc.) corresponds to a risk level score R, which is calculated from factors such as user role U, device fingerprint D, geographical location G, and access time T, and is represented as: R = f(U, D, G, T), f() is a weighted aggregation function, which is mapped to a discrete risk level (low / medium / high) after weighted aggregation. For example, the calculation formula of the risk level score is as follows:

[0104] R= ·U+ ·D+ ·G+ ·T

[0105] + + + =1

[0106] wherein U represents a user role, is a first weight of the user role, D represents a device fingerprint, is a first weight of the device fingerprint, G represents a geographical location, is a first weight of the geographical location, T represents an access time, is a first weight of the access time.

[0107] The risk level score R can be mapped to a discrete risk level (low / medium / high) according to the risk level score R, for example: low risk: R ∈ [0, 0.3); medium risk: R ∈ [0.3, 0.7); high risk: R ∈ [0.7, 1].

[0108] According to an embodiment of the present application, determining the second weight based on the first weight includes operations S4301-S4302.

[0109] In operation S4301, historical risk events are statistically analyzed to determine the first weight corresponding to the context factor.

[0110] The distribution of the first weight can be determined by expert experience or by historical data analysis method (statistical analysis of the triggering frequency of each factor in historical risk events, and higher weight is assigned to high-frequency factors).

[0111] For example, in a financial scenario, the first weight of the user role ( = 0.5), the first weight of the device fingerprint ( = 0.3), the first weight of the geographic location ( = 0.15), and the first weight of the access time ( = 0.05). In an internal management scenario, the first weight of the device fingerprint ( = 0.4), the first weight of the geographic location ( = 0.3), the first weight of the user role ( = 0.2), and the first weight of the access time ( = 0.1).

[0112] In operation S4302, the first weight corresponding to the context factor is adjusted by an optimization adjustment strategy to determine the second weight corresponding to the context factor.

[0113] The optimization adjustment strategy includes but is not limited to real-time feedback optimization, scenario adaptive template, supervised learning, and reinforcement learning.

[0114] Real-time feedback optimization: when a factor (such as device fingerprint) frequently triggers high-risk events in a short period of time, the system automatically increases its weight (such as the second weight β of the device fingerprint from 0.3 to 0.4). If a factor is risk-free for a long time, gradually reduce the weight (such as the second weight δ of the access time decays by 5% per week).

[0115] Scenario adaptive template: multiple weight templates (such as "external user access template" and "audit mode template") are preset and automatically switched according to business needs. For example, in the audit mode, the second weight α of the user role is increased to 0.6 and the second weight β of the device fingerprint is reduced to 0.1.

[0116] Supervised learning: use a labeled data set (different context combinations correspond to risk levels) to train a regression model to fit the optimal weight.

[0117] Reinforcement learning: simulate attack behavior and dynamically adjust the weight according to the defense effect (such as when the attack bypasses the geographic factor, the second weight γ of the geographic location is increased).

[0118] In the embodiments of the present application, the factor weight is adjusted by the optimization adjustment strategy, the weight is dynamically optimized, the accuracy of the context scoring model is improved, and the context analysis effect is optimized.

[0119] At operation S440, the risk level score and the context factor are weighted processed according to the second weight corresponding to the context factor, to obtain a desensitization intensity score.

[0120] The calculation formula of the desensitization intensity score is:

[0121] S = a R + b D + g G + d T

[0122] a + b + g + d = 1

[0123] S represents the desensitization intensity score, R represents the risk level score, D represents the device fingerprint, G represents the geographic location, T represents the access time, a represents the second weight of the user role, b represents the second weight of the device fingerprint, g represents the second weight of the geographic location, and d represents the second weight of the access time.

[0124] Suppose the context factors of a visit are as follows: user role: ordinary user (U = 0.5), device fingerprint: jailbroken device (D = 0.8), geographic location: overseas IP (G = 0.7), access time: early morning (T = 0.6) weight distribution (financial scenario template). The first weights are respectively: = 0.4, = 0.3, = 0.2, = 0.1, and the second weights are respectively: a = 0.5, b = 0.3, g = 0.15, and d = 0.05.

[0125] The risk level score R is:

[0126]

[0127] The desensitization intensity score S is:

[0128]

[0129] At operation S450, a level mapping is performed based on the desensitization intensity score to determine the current desensitization intensity level.

[0130] Through level mapping, the desensitization intensity score is mapped to discrete levels (low / medium / high), for example: low intensity: S ∈ [0, 0.3); medium intensity: S ∈ [0.3, 0.7); high intensity: S ∈ [0.7, 1].

[0131] In the embodiments of the present application, the risk level score is quantified by the context factor, the risk level score is taken as a key indicator of the overall security of the current access environment, the current desensitization intensity level is determined in real time, the context dynamic response is realized, the perception ability of the user environment context is improved, and the data is dynamically desensitized.

[0132] Figure 5 A flowchart of dynamically selecting a desensitization strategy according to the dynamic data desensitization method of the embodiment of the application is shown.

[0133] As shown in Figure 5 The sensitive field type includes a field-level label and a semantic-level label. In operation S230, a desensitization strategy is dynamically selected based on the sensitive field type and the current desensitization strength level, and the target desensitization strategy includes operations S510-S530.

[0134] In operation S510, a field-level strategy is determined according to the field-level label.

[0135] The desensitization mode of the field-level strategy can process structured data and is suitable for standardized and fixed-format sensitive fields such as an ID card, a mobile phone number, and a bank card number. Illustratively, a mask (keep the first 6 digits and the last 4 digits, and fill the middle with *): 123456********0000; a mask (keep the last 4 digits): 12345678912345****; and truncation (only display part of the field): tail number 0000.

[0136] In operation S520, a semantic-level strategy is determined according to the semantic-level label.

[0137] The desensitization mode of the semantic-level strategy can process unstructured text data and is suitable for text descriptions containing sensitive semantics such as transaction content (“salary transfer”) and address details (“a community in Haidian District, Beijing”).

[0138] In operation S530, a target desensitization strategy is determined through a dynamic desensitization strategy engine according to the field-level label, the semantic-level label, and the current desensitization strength level; the target desensitization strategy includes one or more of the field-level strategy, the semantic-level strategy, and a field-semantic superposition strategy; and the field-semantic superposition strategy includes the field-level strategy and the semantic-level strategy.

[0139] The field-semantic superposition strategy is the field-level strategy + the semantic-level strategy, and the strategy needs to be superimposed when a field has both structured sensitive data and contextual sensitive semantics. For example, the content of a certain field is “transaction note: Zhang San’s salary transfer to Li Si (account number 1234555555551234)”, and the superimposed processing logic is as follows: first, field-level desensitization: through a mask, such as an account number mask 1234********1234; and second, semantic-level desensitization: through a fuzzy transaction type, such as Zhang San’s account transfer to Li Si (account number 1234********1234).

[0140] According to an embodiment of the present application, in operation S530, a target de-sensitization policy is determined by a dynamic de-sensitization policy engine according to the field-level label, the semantic-level label, and the current de-sensitization strength level, including operation S5301-S5302.

[0141] In operation S5301, a current policy combination is determined according to the field-level label, the semantic-level label, and the current de-sensitization strength level based on a rule matrix.

[0142] The mapping rule of the rule matrix includes: selecting a field-level policy or a semantic-level policy based on a single-policy trigger condition; selecting a field-semantic superimposed policy based on a superimposed-policy trigger condition; and determining a current de-sensitization strength rule according to the current de-sensitization strength level.

[0143] The built-in rule matrix maps the field label (field-level label and semantic-level label) and the de-sensitization strength level (S value) to a predefined policy combination, i.e., determines the current policy combination, which can be a single field-level policy, a single semantic-level policy, a combination of a field-level policy and a field policy, a combination of a semantic-level policy and a semantic-level policy, a combination of a field-level policy and a semantic-level policy (i.e., a field-semantic superimposed policy), a combination of a field-semantic superimposed policy and a field-level policy, a combination of a field-semantic superimposed policy and a semantic-level policy, etc. The rule matrix supports custom rule extension (e.g., a specific field is forced to enable quantum disturbance), and an example of the rule matrix is shown in Table 1.

[0144] Table 1

[0145]

[0146] The single-policy trigger condition is that there is only a single field label for a sensitive field. For example, if a certain sensitive field is only a field-level label, the field is de-sensitized by a field-level policy; if a certain sensitive field is only a semantic-level label, the field is de-sensitized by a semantic-level policy.

[0147] The superimposed-policy trigger condition includes a high de-sensitization strength level (indicating a high-risk context environment), a mixed sensitive field (the label of the sensitive field type exists both field-level label and semantic-level label), and compliance requirement upgrade.

[0148] High de-sensitization strength level: even if the field type only needs field-level de-sensitization, a semantic-level policy is still needed. For example, an ID number needs not only masking but also adding noise disturbance when S=high.

[0149] Mixed sensitive field: when a field contains both structured data and sensitive semantics, the combined policy superimposed policy is enabled by default. For example, address: Beijing Haidian District XX Road No. 1 (Li Si collection), field-level policy: mask the house number -> ** Road No., semantic-level policy: blur the recipient -> * user collection.

[0150] Compliance requirement upgrade: If the compliance level of the business scenario is upgraded (such as financial regulatory review), the field semantic superposition strategy is forced to be enabled for all fields.

[0151] In the embodiments of the present application, real-time strategy mapping is performed based on the desensitization strength level analyzed in real time by the context scoring model, and single strategy or superposition strategy can be intelligently selected based on the sensitive field type and the desensitization strength level, so as to cope with different levels of security threats while guaranteeing data availability, realize multi-level fusion of field-level desensitization and semantic-level desensitization, and enhance the protection depth.

[0152] The desensitization strength rule determines the desensitization strength level and the strategy strictness. Exemplarily, the desensitization strength rule is as follows:

[0153] Low strength (S=low): only basic desensitization (such as partial masking or light blur) is applied.

[0154] Medium strength (S=medium): the desensitization granularity is increased (such as full-field masking or semantic rewriting).

[0155] High strength (S=high): the field semantic superposition strategy is forced, and multiple desensitization rules are superposed.

[0156] Through the above rules, the system can intelligently select single strategy or combined strategy superposition strategy based on the sensitive field type and the desensitization strength level of the dynamic risk score, so as to cope with different levels of security threats while guaranteeing data availability.

[0157] In operation S5302, the target desensitization strategy is determined based on the current strategy combination and the current desensitization strength rule.

[0158] An example of dynamic matching of the target strategy is as follows:

[0159] Scenario 1: the user role is “external auditor” (S=high), and the accessed field is “transaction note”.

[0160] Scenario 1 target strategy: field level (mask account number) + semantic level (blur transaction type).

[0161] Scenario 2: the user role is “internal administrator” (S=low), and the accessed field is “mobile phone number”.

[0162] Scenario 2 target strategy: only field-level masking.

[0163] In the embodiments of the present application, through the dynamic desensitization strategy engine, the selected target desensitization strategy changes when the current desensitization strength level changes, so as to meet the dual requirements of compliance and business flexibility and improve the dynamic adjustment capability of the desensitization strategy.

[0164] According to the embodiment of the present application, the first desensitization data is irreversibly desensitized in operation S240 to generate the second desensitization data, including operation S2401-S2402.

[0165] In operation S2401, quantum noise is simulated based on a quantum noise disturbance mechanism to simulate quantum measurement disturbance characteristics.

[0166] In operation S2402, the first desensitization data is disturbed based on the simulated quantum noise to generate the second desensitization data.

[0167] Figure 6 The quantum disturbance flowchart of the dynamic data desensitization method according to the embodiment of the present application is schematically shown. The quantum noise disturbance mechanism is introduced, which can simulate quantum measurement disturbance characteristics through a pseudo-random generator, or use a pseudo-random disturbance function simulating quantum measurement disturbance characteristics to generate simulated quantum noise, disturb the first desensitization data, add simulated quantum noise to the first desensitization data, and generate an irreversibly output result, so that it loses the possibility of restoration at the data pattern level and prevents reverse engineering attacks.

[0168] In the embodiment of the present application, irreversible quantum noise disturbance mechanism is used to realize irreversible quantum disturbance encryption, generate irreversibly decrypted data, make the decrypted data lose the possibility of restoration at the data pattern level, prevent reverse engineering attacks, further prevent reconstruction attacks after data leakage, and enhance data protection capabilities.

[0169] Figure 7 Another flowchart of the dynamic data desensitization method according to the embodiment of the present application is schematically shown.

[0170] As Figure 7 shown, the dynamic data desensitization method of this embodiment includes operations S701-S710,

[0171] In operation S701, in response to a user's data access request, the original data corresponding to the data access request is obtained, and the original data is subjected to sensitive field identification through a natural language processing model to obtain sensitive fields and sensitive field types; it should be noted that operation S701 is the same as the method of operation S210 described above, and will not be repeated here.

[0172] In operation S702, user access information corresponding to the data access request is collected in real time, and the current desensitization strength level is generated by analyzing the user access information through a context scoring model; it should be noted that operation S702 is the same as the method of operation S220 described above, and will not be repeated here.

[0173] In operation S703, the access permission is determined according to the user's permission level.

[0174] At operation S704, the environment security degree is determined according to the device credibility, the Internet protocol address, and the access period.

[0175] At operation S705, the risk degree is determined according to the current desensitization intensity level.

[0176] At operation S706, it is judged whether the access permission, the environment security degree, and the risk degree satisfy the safe review condition. When the access permission, the environment security degree, and the risk degree all satisfy the safe review condition, operation S707 is executed. When any one of the access permission, the environment security degree, and the risk degree does not satisfy the safe review condition, operations S708-S710 are executed.

[0177] The judgment basis for returning normal data (non-desensitized data) to the user is the safe review condition, and the safe review condition includes sufficient access permission, credible environment security degree, and up-to-standard risk degree.

[0178] Sufficient access permission: the user role has “full data access permission” (such as an administrator or an auditor).

[0179] Credible environment security degree: device fingerprint is credible (such as an intranet device of an enterprise), geographic location is compliant (such as a company IP segment), and access time is normal (such as working hours).

[0180] Up-to-standard risk degree: desensitization intensity level = low, indicating that the current access environment has no abnormal risk. If the above conditions are all satisfied, the original data can be returned after skipping the desensitization processing or operation S707 is executed to return the related request data; otherwise, operations S708-S710 are executed according to the desensitization intensity level for dynamic desensitization.

[0181] At operation S707, the second request data is determined based on the original data, and the second request data is returned to the user.

[0182] When the user has data review permission, the original data can be processed by a desensitization adjustment mode to return the second request data, and it is further determined whether desensitized data needs to be returned in the desensitization adjustment mode.

[0183] The desensitization adjustment mode includes but is not limited to integrating the permission layer and the context factor and extending the dynamic desensitization rule engine.

[0184] Integrate the permission layer with the context factors: (1) Collect permission identifiers: In the context awareness module, user role information needs to explicitly include "permission level" (such as "high permission user" and "ordinary user"). For example, if the user's permission is "data administrator" or "auditor", it is marked as a high permission role. (2) Associate permissions with risk scores: In the context scoring model, the permission level can be used as an independent factor or directly override the risk level. For example: High permission user: If the user's permission is high enough (such as system administrator), the risk level can be directly set to the lowest (R = low), and the desensitization strength S = low, thereby triggering the "no desensitization" strategy. For example, the user permission level can be collected explicitly and bound with the role identifier, and in the context scoring model, the highest weight (such as the value of a is significantly higher than other factors) is assigned to the permission to ensure that the permission directly dominates the desensitization decision. (3) Dynamically balance permissions and risks: If the user's permission is high but the access environment is risky (such as an abnormal IP), the overall desensitization strength score is calculated through weighted calculation to determine whether to partially desensitize.

[0185] Expand the dynamic desensitization strategy engine: (1) Add a permission threshold to the rule engine, for example: If the user's permission ≥ the preset threshold (such as "full access permission"), skip the desensitization process and return the original data directly, and if the permission is insufficient but the risk score is low, apply light desensitization as needed. For example, if the permission level is "full access permission" and the risk level = low, the dynamic desensitization strategy engine returns the original data directly. If the permission is insufficient, apply the dynamically selected desensitization strategy according to the desensitization process to generate desensitized data. (2) Strategy matching priority: The permission priority is higher than other context factors. For example, even if the device fingerprint is abnormal, a high permission user can still obtain complete data, but audit logs need to be recorded.

[0186] In operation S708, a desensitization strategy is dynamically selected based on the type of sensitive field and the current desensitization strength level, a target desensitization strategy is determined, and the sensitive field is processed through the target desensitization strategy to obtain first desensitized data. It should be noted that operation S708 is the same as the method of operation S230 described above, and will not be repeated here.

[0187] In operation S709, the first desensitized data is subjected to irreversible desensitization processing to generate second desensitized data. It should be noted that operation S709 is the same as the method of operation S240 described above, and will not be repeated here.

[0188] In operation S710, the first request data is determined based on the original data and the second desensitized data, and the first request data is returned to the user. It should be noted that operation S710 is the same as the method of operation S250 described above, and will not be repeated here.

[0189] In the embodiments of the present application, the original data is returned under the condition that the safe access condition is met, the request is efficiently responded under the premise of guaranteeing data security, the risk control and user experience are balanced, and the data service reliability is improved.

[0190] Based on the dynamic data desensitization method described above, the present application further provides a dynamic data desensitization device. In the following, the device will be described in detail. Figure 8 The device will be described in detail.

[0191] Figure 8 The structure block diagram of the dynamic data desensitization device according to the embodiments of the present application is schematically shown.

[0192] As shown in Figure 8 The dynamic data desensitization device 800 of the embodiments includes a natural language processing module 810, a context analysis module 820, a first desensitization module 830, a second desensitization module 840, and a desensitization data returning module 850.

[0193] The natural language processing module 810 is configured to obtain original data corresponding to a data access request of a user in response to the data access request, and perform sensitive field identification on the original data through a natural language processing model to obtain sensitive fields and sensitive field types. In an embodiment, the natural language processing module 810 can be configured to perform the operation S210 described above, and details are not repeated here.

[0194] The context analysis module 820 is configured to collect user access information corresponding to the data access request in real time, and analyze the user access information through a context scoring model to generate a current desensitization strength level. In an embodiment, the context analysis module 820 can be configured to perform the operation S220 described above, and details are not repeated here.

[0195] The first desensitization module 830 is configured to dynamically select a desensitization strategy based on the sensitive field types and the current desensitization strength level, determine a target desensitization strategy, and process the sensitive fields through the target desensitization strategy to obtain first desensitized data. In an embodiment, the first desensitization module 830 can be configured to perform the operation S230 described above, and details are not repeated here.

[0196] The second desensitization module 840 is configured to perform irreversible desensitization processing on the first desensitized data to generate second desensitized data. In an embodiment, the second desensitization module 840 can be configured to perform the operation S240 described above, and details are not repeated here.

[0197] The desensitization data returning module 850 is configured to determine first request data based on the original data and the second desensitized data, and return the first request data to the user. In an embodiment, the desensitization data returning module 850 can be configured to perform the operation S250 described above, and details are not repeated here.

[0198] According to an embodiment of the present application, the sensitive field type includes a field-level label and a semantic-level label; the first desensitization module 830 includes: a field policy unit configured to determine a field-level policy according to the field-level label; a semantic policy unit configured to determine a semantic-level policy according to the semantic-level label; and a dynamic engine unit configured to determine a target desensitization policy through a dynamic desensitization policy engine according to the field-level label, the semantic-level label, and a current desensitization intensity level; wherein the target desensitization policy includes one or more of the field-level policy, the semantic-level policy, and a field-semantic superposition policy; and the field-semantic superposition policy includes the field-level policy and the semantic-level policy.

[0199] According to an embodiment of the present application, the dynamic engine unit is further configured to perform the target desensitization policy in a priority mechanism; wherein the priority mechanism includes: a priority of the field-level policy is higher than a priority of the semantic-level policy; and in a case where the current desensitization intensity level is high, performing secondary processing on a desensitization processing result of the semantic-level policy based on the field-level policy.

[0200] According to an embodiment of the present application, the dynamic engine unit includes: a policy combination sub-unit configured to determine a current policy combination based on a rule matrix according to the field-level label, the semantic-level label, and the current desensitization intensity level; and a target policy sub-unit configured to determine the target desensitization policy based on the current policy combination and a current desensitization intensity rule; wherein a mapping rule of the rule matrix includes: selecting the field-level policy or the semantic-level policy based on a single-policy trigger condition; selecting the field-semantic superposition policy based on a superposition policy trigger condition; and determining the current desensitization intensity rule according to the current desensitization intensity level.

[0201] According to an embodiment of the present application, the second desensitization module 840 includes: a quantum simulation unit configured to simulate quantum measurement disturbance characteristics based on a quantum noise disturbance mechanism to generate simulated quantum noise; and a data disturbance unit configured to disturb the first desensitization data based on the simulated quantum noise to generate second desensitization data.

[0202] According to an embodiment of the present application, the context analysis module 820 includes: an acquisition unit configured to acquire a context factor of user access information; a quantization unit configured to numerically quantize the context factor to determine a factor score corresponding to the context factor; a risk level scoring unit configured to weight the factor score corresponding to the context factor based on a first weight corresponding to the context factor to obtain a risk level score; a desensitization intensity scoring unit configured to weight process the risk level score and the context factor according to a second weight corresponding to the context factor to obtain a desensitization intensity score; wherein the second weight is determined based on the first weight; and an intensity rating unit configured to map the desensitization intensity score to a level to determine the current desensitization intensity level.

[0203] According to an embodiment of the present application, the context analysis module 820 further comprises a factor weight determination unit configured to: statistically analyze historical risk events, and determine a first weight corresponding to the context factor; and adjust the first weight corresponding to the context factor by optimizing the adjustment strategy, and determine a second weight corresponding to the context factor.

[0204] According to an embodiment of the present application, the context factor comprises one or more of a user role, a device fingerprint, a geographic location, and an access time; and the quantization unit comprises: a first quantization sub-unit configured to determine a factor score corresponding to the user role based on a user permission level corresponding to the user role; a second quantization sub-unit configured to determine a factor score corresponding to the device fingerprint based on a device trustworthiness corresponding to the device fingerprint; a third quantization sub-unit configured to determine a factor score corresponding to the geographic location based on an Internet Protocol address corresponding to the geographic location; and a fourth quantization sub-unit configured to determine a factor score corresponding to the access time based on an access time period corresponding to the access time.

[0205] According to an embodiment of the present application, the device 800 further comprises a normal data return module configured to: determine an access permission based on the user permission level; determine an environment security degree based on the device trustworthiness, the Internet Protocol address, and the access time period; determine a risk degree based on the current desensitization intensity level; and in a case where the access permission, the environment security degree, and the risk degree all satisfy a safe review condition, determine second request data based on the original data, and return the second request data to the user.

[0206] According to embodiments of the present application, any of the natural language processing module 810, the context analysis module 820, the first desensitization module 830, the second desensitization module 840 and the desensitization data returning module 850 can be combined in one module, or any of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of the other modules, and implemented in one module. According to embodiments of the present application, at least one of the natural language processing module 810, the context analysis module 820, the first desensitization module 830, the second desensitization module 840 and the desensitization data returning module 850 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging a circuit, etc. or implemented by hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the natural language processing module 810, the context analysis module 820, the first desensitization module 830, the second desensitization module 840 and the desensitization data returning module 850 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding function.

[0207] Figure 9 A block diagram of an electronic device suitable for implementing the dynamic data desensitization method according to embodiments of the present application is schematically shown.

[0208] As shown in Figure 9 , the electronic device 900 according to embodiments of the present application includes a processor 901 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 902 or loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 can include, for example, a general purpose microprocessor (e.g. a CPU), an instruction set processor and / or a related chipset and / or a special purpose microprocessor (e.g. an application specific integrated circuit (ASIC)), etc. The processor 901 can also include an on-board memory for cache use. The processor 901 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present application.

[0209] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other via the bus 904. The processor 901 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs can also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0210] According to the embodiments of the present application, the electronic device 900 can further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 can further include one or more of the following components connected to the input / output (I / O) interface 905: an input part 906 including a keyboard, a mouse, and the like; an output part 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage part 908 including a hard disk, and the like; and a communication part 909 including a network interface card such as a LAN card, a modem, and the like. The communication part 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as necessary. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 910 as necessary, so that a computer program read therefrom is installed in the storage part 908 as necessary.

[0211] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present application is implemented.

[0212] According to an embodiment of the present application, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, can include but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this application, a computer readable storage medium can be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include one or more of the above-described ROM 902 and / or RAM 903 and / or a memory other than the ROM 902 and the RAM 903.

[0213] Embodiments of the present application also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the dynamic data de-sensitization method provided by the embodiments of the present application.

[0214] The above-described functions defined in the system / device / apparatus of the embodiments of the present application are performed when the computer program is executed by the processor 901. According to an embodiment of the present application, the above-described system, device, module, unit, etc. can be implemented by computer program modules.

[0215] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal on a network medium, and be downloaded and installed through the communication part 909, and / or installed from the detachable medium 911. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

[0216] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the detachable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiments of the present application are performed. According to an embodiment of the present application, the above-described system, device, apparatus, module, unit, etc. can be implemented by computer program modules.

[0217] According to embodiments of the present application, program code for implementing the computer programs provided by embodiments of the present application can be written in any combination of one or more programming languages, and can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. Programming languages include, but are not limited to, Java, C++, python, "C", or the like. Program code can execute entirely on a user's computing device, partly on the user's device, as a stand-alone software package, partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0218] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0219] Those skilled in the art will understand that features recited in the various embodiments of the present application can be combined and / or integrated in various combinations and / or permutations, even if such combinations and / or permutations are not expressly noted in the present application. In particular, features recited in the various embodiments of the present application can be combined and / or integrated in various combinations and / or permutations without departing from the spirit and teachings of the present application. All such combinations and / or integrations are within the scope of the present application.

Claims

1. A dynamic data de-sensitization method, characterized in that, The method comprises: in response to a user's data access request, obtaining original data corresponding to the data access request, and performing sensitive field identification on the original data through a natural language processing model to obtain sensitive fields and sensitive field types; real-time collection of user access information corresponding to the data access request, and analysis of the user access information through a context scoring model to generate a current desensitization intensity level; based on the sensitive field types and the current desensitization intensity level, dynamically selecting a desensitization strategy, determining a target desensitization strategy, and processing the sensitive fields through the target desensitization strategy to obtain first desensitized data; irreversible desensitization processing of the first desensitized data to generate second desensitized data; and determination of first request data based on the original data and the second desensitized data, and return of the first request data to the user.

2. The method of claim 1, wherein, The sensitive field types include field-level labels and semantic-level labels; The method comprises: determining a field-level strategy according to the field-level labels; determining a semantic-level strategy according to the semantic-level labels; and determining the target desensitization strategy through a dynamic desensitization strategy engine according to the field-level labels, the semantic-level labels, and the current desensitization intensity level; wherein the target desensitization strategy includes one or more of the field-level strategy, the semantic-level strategy, and a field semantic superposition strategy; the field semantic superposition strategy includes the field-level strategy and the semantic-level strategy.

3. The method of claim 2, wherein, The target desensitization strategy is executed in a priority mechanism; wherein the priority mechanism includes: the priority of the field-level strategy is higher than the priority of the semantic-level strategy; and in the case that the current desensitization intensity level is high, the desensitization processing result of the semantic-level strategy is covered for secondary processing based on the field-level strategy.

4. The method of claim 2, wherein, The method comprises: determining a current strategy combination based on a rule matrix according to the field-level labels, the semantic-level labels, and the current desensitization intensity level; and determining the target desensitization strategy based on the current strategy combination and a current desensitization intensity rule; wherein the mapping rule of the rule matrix includes: selecting the field-level strategy or the semantic-level strategy based on a single-strategy trigger condition; selecting the field semantic superposition strategy based on a superposition strategy trigger condition; and determining the current desensitization intensity rule according to the current desensitization intensity level.

5. The method of claim 1, wherein, The method comprises: simulating quantum measurement disturbance characteristics based on a quantum noise disturbance mechanism to generate simulated quantum noise; and based on the simulated quantum noise, perturbing the first desensitized data to generate the second desensitized data.

6. The method of claim 1, wherein, The method comprises: obtaining a context factor of the user access information; numerically quantifying the context factor to determine a factor score corresponding to the context factor; weighting the factor score corresponding to the context factor based on a first weight corresponding to the context factor to obtain a risk level score; weighting the risk level score and the context factor based on a second weight corresponding to the context factor to obtain a desensitization strength score, wherein the second weight is determined based on the first weight; and determining a current desensitization strength level based on level mapping based on the desensitization strength score.

7. The method of claim 6, wherein, determining the second weight based on the first weight includes: statistically analyzing historical risk events to determine the first weight corresponding to the context factor; and adjusting the first weight corresponding to the context factor by optimizing an adjustment strategy to determine the second weight corresponding to the context factor.

8. The method of claim 6, wherein, The context factor includes one or more of a user role, a device fingerprint, a geographic location, and an access time; and the numerically quantifying the context factor to determine a factor score corresponding to the context factor includes: determining a factor score corresponding to the user role based on a user permission level corresponding to the user role; determining a factor score corresponding to the device fingerprint based on a device trustworthiness corresponding to the device fingerprint; determining a factor score corresponding to the geographic location based on an Internet Protocol address corresponding to the geographic location; and determining a factor score corresponding to the access time based on an access time period corresponding to the access time.

9. The method of claim 8, wherein, The method further includes: determining an access permission based on the user permission level; determining an environment security degree based on the device trustworthiness, the Internet Protocol address, and the access time period; determining a risk degree based on the current desensitization strength level; and in a case where the access permission, the environment security degree, and the risk degree all satisfy a safe review condition, determining second request data based on the original data and returning the second request data to the user.

10. A dynamic data desensitization apparatus, comprising: The apparatus includes: a natural language processing module configured to, in response to a data access request of a user, obtain original data corresponding to the data access request, and perform sensitive field identification on the original data through a natural language processing model to obtain a sensitive field and a sensitive field type; a context analysis module configured to collect user access information corresponding to the data access request in real time, and analyze the user access information through a context scoring model to generate a current desensitization strength level; a first desensitization module configured to dynamically select a desensitization strategy based on the sensitive field type and the current desensitization strength level, determine a target desensitization strategy, and process the sensitive field through the target desensitization strategy to obtain first desensitization data; a second desensitization module configured to perform irreversible desensitization processing on the first desensitization data to generate second desensitization data; and a desensitization data return module configured to determine first request data based on the original data and the second desensitization data, and return the first request data to the user.

11. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-9.

12. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions, when executed by a processor, implement the steps of the method according to any one of claims 1-9.

13. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions, when executed by a processor, implement the steps of the method according to any one of claims 1-9. The computer program or instructions, when executed by a processor, implement the steps of the method according to any one of claims 1-9.

Images