Data privacy protection method for data governance system

Abstract

The invention provides a data privacy protection method for a data governance system, and belongs to the technical field of data governance, and the method comprises the steps: carrying out the cross verification of multi-source feature data and the unique identification information of an object collected on site, generating an original data set, carrying out the sensitive information recognition and grading, and generating the preprocessing data with a sensitive grade label; core identification information in the preprocessed data is disassembled to generate standardized desensitized data conforming to privacy protection, a bidirectional encryption mapping relation is established between object unique identification information collected on site and the standardized desensitized data, an encryption index is formed, the encryption index and preset multi-dimensional compliance data are fused, and a data fusion result is obtained; generating standardized fusion data; and based on the access token, generating a differential authorization data set divided according to permission granularity, performing privacy disclosure risk assessment, generating a risk level, performing privacy processing on the risk level, and outputting the risk level to a risk control system. And the data management efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data governance, in particular to a data privacy protection method for a data governance system. BACKGROUND

[0002] In the current situation of the booming real estate industry and accelerating digital transformation, real estate data governance has become a key link. From real estate information collection to property transaction and a series of business processes, a large amount of multi-source data is generated, covering real estate listing information, property registration data, spatial coordinate information, and owner association information. However, the current real estate data governance faces many difficulties in privacy protection. For example, in the data collection process, there are problems such as diverse data sources and non-uniform formats. The recording methods of real estate information collected by different platforms, such as house area and house type structure, are different. The unique identification information collected on site, such as building coordinates, may be biased due to factors such as surveying and mapping equipment and personnel operation, making it difficult to guarantee the accuracy and completeness of the original data set, and thus affecting subsequent data processing and analysis. Moreover, the existing static permission allocation mode does not fully consider the dynamic nature of real estate data and the diversity of business scenarios. Different user roles, such as real estate agents, bank credit officers, and government regulators, have different data needs and sensitivity levels in different business scenarios (such as real estate promotion, loan approval, and market supervision). The current static permission mode cannot guarantee the security of highly sensitive data and meet the access needs of legitimate users in reasonable scenarios. At the same time, the privacy leakage risk assessment also relies on fixed indicators, which cannot accurately reflect the risk status of data in different use scenarios in real time. All the above factors will lead to low efficiency of data governance.

[0003] Therefore, the present application provides a data privacy protection method for a data governance system. SUMMARY

[0004] The present application provides a data privacy protection method for a data governance system to solve the above technical problems.

[0005] The present application provides a data privacy protection method for a data governance system, comprising: Step 1: Based on the multi-source collection module, obtain the multi-source feature data of the target object, and cross-verify with the object unique identification information collected on site to generate an original data set; Step 2: Based on the original data set, identify and classify sensitive information to generate preprocessed data with sensitive level labels; Step 3: Disassemble the core identification information in the preprocessed data and match it with the pre-constructed standardized desensitization rule library to generate standardized desensitization data that meets privacy protection requirements; Step 4: Establish a bidirectional encryption mapping relationship between the on-site collected object unique identification information and the standardized desensitization data, form an encryption index, fuse the encryption index with the preset multi-dimensional compliance data, and generate standardized fusion data; Step 5: Based on the standardized fusion data and the identity permission characteristics of the user, generate an access token, generate differentiated authorization data sets according to the permission granularity based on the access token, perform privacy leakage risk assessment and generate a risk level, and output the risk level to the risk control system after privacy processing.

[0006] Preferably, step 1 comprises: According to the target object type, the acquisition strategy is automatically matched to form a multi-modal feature data set with acquisition source identification, wherein the target object type includes text, audio and image; Obtain the object unique identification information measured on site, including spatial coordinates and physical feature codes collected by the measuring device, and mark the anti-tampering by using the block chain timestamp; Based on the rule engine, the explicit fields in the multi-modal feature data set and the unique identification information are format checked, and the fuzzy description in the feature data is associated and matched with the unique identification spatial coordinates to identify the data mode conflict; According to the conflict coefficient Cx of the data mode conflict, a secondary acquisition instruction is triggered to supplement the data dimension, and the conflict data is pushed to the artificial review node; The data set that passes the verification is subjected to preliminary masking processing of sensitive fields, and the original data set with data blood relationship markers and security level preliminary judgment is generated after writing into the distributed storage node with additional acquisition link watermark.

[0007] Preferably, the conflict coefficient Cx of the data mode conflict is calculated, comprising:

[0008] Among them, is the total number of explicit fields; is the format error rate of the i-th field; is the importance weight of the i-th field, which is dynamically assigned by the rule engine based on data sensitivity; is the spatial matching confidence; is the acquisition source confidence score; is the historical conflict times; is the total number of historical acquisition times; is the fine-tuning function; is the number of conflicts in the current preset period; is the historical average preset period conflict times of the corresponding data source; is the standard deviation of the historical conflict times; is a manual review correction coefficient for the kth conflict sample; is a time decay factor; p is the total number of conflict samples; is a conflict coefficient for the kth conflict sample; is an adaptive correction term; is a conflict outbreak coefficient; is a dynamic weight coefficient, and .

[0009] Preferably, the additional acquisition link watermark includes: determining the acquisition work attribute of the acquisition node, and matching a first string of a first length and a second string of a second length from the node-watermark table according to the node number of the acquisition node; capturing a custom string for the acquisition node, and determining a character length range in combination with the real-time acquisition attribute of the acquisition node; randomly selecting a character length from the character length range, and performing cutting processing or padding processing on the first length and the second length before performing splicing processing to obtain a first new segment; determining the hidden position of each acquisition type involved in the data set that passes the verification respectively; constructing a timestamp-type pair of the data set that passes the verification to obtain a data acquisition track, wherein the timestamp-type pair is the acquisition data type combination of the data set that passes the verification at each data acquisition time; determining a highlight point set of the data acquisition track, and locking a first position of a minimum highlight point, a second position of two highlight points in the highlight point set farthest from the minimum highlight point, and a third position of two highlight points with the maximum absolute value difference from the minimum highlight point; constructing an output shape from a first intermediate point of the second position, a second intermediate point of the third position, and the minimum highlight point, wherein the output shape is a straight line shape or a triangular shape; proportionally extracting a new shape from the output shape according to the time coverage length of each acquisition type, and constructing a function of the new shape; generating an additional segment of each acquisition type according to the position size and position allowed deviation relationship of the hidden position, and in combination with the hardware fingerprint of the acquisition node, the acquisition timestamp, the data type identifier, and the link feature code generated by the characteristic hash value of the original data and the function of the new shape; combining the first new segment and the additional segment to obtain a sub-watermark corresponding to the acquisition type, and further obtaining the acquisition link watermark.

[0010] Preferably, step 2 includes: Multi-modal analysis is performed on the original data set, and the analysis results of different data types are marked based on a pre-built sensitive word library. At the same time, the spatial coordinate association information of different data types is obtained; Based on the spatial correlation rule base, the spatial coordinate association information is analyzed to identify implicit sensitive data that has geographical correlation with the sensitive area marked with sensitive data. The basic sensitivity of a single sensitive field in the implicit sensitive data is multiplied by the combined risk coefficient between the fields to obtain a comprehensive sensitivity value. The comprehensive sensitivity value is dynamically adjusted in combination with the data timeliness feature, and a sensitive level label is mapped to generate preprocessed data with a level label.

[0011] Preferably, step 3 comprises: Multi-level semantic disassembly is performed on the core identification information in the preprocessed data to obtain the disassembly component type and sensitive level label of each core identification information. From the pre-built standardized desensitization rule base, match the basic desensitization rule consistent with the disassembly component type and sensitive level label to the local data associated with the corresponding core identification information for desensitization processing, and generate standardized desensitization data with desensitization rule identification.

[0012] Preferably, step 4 comprises: The object unique identification information collected on site is encrypted, and the standardized desensitization data is hashed. Based on the encrypted identification information and the hashed desensitization data, a dynamic mapping table is constructed, wherein the encrypted digest of the identification information is used as the primary key, and the hash value of the standardized desensitization data is used as the value, forming a basic mapping relationship. Based on the basic mapping relationship, an encrypted index is generated, wherein the leaf node of the index stores the encrypted fragment of the basic mapping relationship, the non-leaf node stores the hash pointer of the fragment position, and each level node is attached with a time stamp and a node signature. The ownership status data, regional average transaction data, and historical risk marking data after desensitization processing are differentially encrypted according to the sensitive level. The associated data fragments are located through the hash pointer in the index, and the secure aggregation algorithm is used to standardize the format of the fused data to generate standardized fusion data with data correlation score and encrypted check code, wherein the data correlation score is dynamically calculated based on the spatial correlation of the identification information and the compliance data. Consistency.

[0013] Preferably, step 5 comprises: Based on the permission parameter in the access token and the pre-set permission-sensitivity level mapping matrix, the standardized fusion data is granularly split to form a differentiated authorization data set with field-level, record-level, and aggregation-level permission granularity. The access trigger parameter of the differentiated authorization data set is collected, compared with the user behavior baseline library, the behavior deviation degree is calculated, and the initial risk value is generated in combination with the sensitive level weighting value of the data set, and the risk level is obtained.

[0014] Compared with the prior art, the beneficial effects of the present application are as follows: Through multi-source collection verification, sensitive classification, accurate desensitization, encryption fusion, dynamic permission and risk control road design, the balance between privacy protection and data usability is realized in real estate data governance, effectively preventing information leakage, effectively solving the problems of privacy security and business demand conflict in real estate data, multi-source data fusion risk and other problems, and improving the efficiency of data governance.

[0015] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be achieved and obtained by the structure specifically pointed out in the written description and the accompanying drawings.

[0016] The technical solutions of the present application will be further described in detail below with the help of the accompanying drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, for explaining the present application, and do not constitute a limitation on the present application. In the drawings: Figure 1 A flowchart of a data privacy protection method for a data governance system in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The preferred embodiments of the present application will be described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and do not limit the present application.

[0019] The present application provides a data privacy protection method for a data governance system, as shown in Figure 1 The method comprises the following steps: Step 1: obtaining multi-source feature data of a target object based on a multi-source collection module, cross-verifying the multi-source feature data with object unique identification information collected on site, and generating an original data set; Step 2: identifying and classifying sensitive information based on the original data set, and generating preprocessed data with sensitive level labels; Step 3: disassembling core identification information in the preprocessed data and matching the core identification information with a pre-constructed standardized desensitization rule library, and generating standardized desensitization data meeting privacy protection requirements; Step 4: Establish a bidirectional encryption mapping relationship between the on-site collected object unique identification information and the standardized desensitized data to form an encrypted index. Fuse the encrypted index with the pre-set multi-dimensional compliance data to generate standardized fusion data. Step 5: Based on the standardized fusion data and the identity and permission characteristics of the user, generate an access token. Based on the access token, generate differentiated authorization data sets divided by permission granularity for privacy leakage risk assessment and generate risk levels. Perform privacy processing on the risk levels and output them to the risk control system.

[0020] In this embodiment, the multi-source collection module refers to a combination of hardware or software used to obtain data from multiple channels. In the real estate scenario, it can include a distributed crawler cluster (to crawl data from real estate platforms), Internet of Things sensor terminals (to collect real estate environment data), API interfaces (to connect government system ownership data), etc. For example, text information of a house listing is crawled from websites such as Lianjia and Beike through a crawler cluster, aerial images of the house are obtained through a drone, and property registration data is obtained through a government API.

[0021] The target object refers to the specific object of data governance, which is usually a house source (such as a house in a certain community, unit 501, building 3).

[0022] Multi-source feature data refers to various types of data related to the target object obtained from different sources, including text (house listing price, house type description), images (house type diagram, indoor photos), audio (owner's voice description of the house), etc.

[0023] On-site collection refers to a method of obtaining data through field survey, including high-precision GPS surveying and mapping (to obtain the latitude and longitude coordinates of the house), laser scanning (to obtain the physical dimensions of the house), manual input (to record the building unit code), etc.

[0024] Object unique identification information refers to irreplaceable information that can uniquely identify the target object, including building unit level spatial coordinates (latitude and longitude) and physical feature codes in the real estate scenario. It needs to be marked with a blockchain timestamp (to ensure that it cannot be tampered with). For example, the unique identification of a certain house is the coordinate (116.4°, 39.9°) and the code XQ01-LD03-DY02 with the blockchain timestamp 202405011030.

[0025] Cross-validation refers to the process of verifying the consistency of data through multi-dimensional comparison. The implementation methods include rule engine verification (format matching), spatial topology algorithm (geographical correlation matching), and anomaly detection model (identifying data conflicts).

[0026] On-site coordinate matching uses the Isolation Forest model to identify conflicting data where the area is 120 square meters but the house type diagram shows only 80 square meters.

[0027] Raw dataset refers to the initial data set generated after cross-validation.

[0028] Sensitive information refers to data that may compromise privacy if leaked, including personal information (property owner ID number, mobile phone number), precise location information (house number, specific coordinates), and sensitive business data (mortgage status, judicial seal information) in the real estate context.

[0029] Sensitive information classification refers to dividing sensitive levels according to the degree of privacy risk, usually divided into L1 (low sensitivity) to L4 (extremely high sensitivity).

[0030] Sensitive level label refers to the identification of marking the sensitivity level of data.

[0031] Preprocessed data refers to structured data with sensitive level labels, which is the intermediate product after the raw dataset is identified and classified. For example: structured data containing house ID: F001, information: Sunshine Community 3# Building 2 Unit 501 Room, and sensitive level: L4.

[0032] Core identification information refers to key information that can directly associate target objects, including property address (such as Beijing Chaoyang District, Sunshine Community 3# Building 2 Unit 501 Room), property owner identity association field (such as property owner A, ID number 110101********1234), and house code (such as Beijing Housing Rights and Interests Certificate Chaoyang District No. XXXX).

[0033] Disassembly refers to the disassembly of core identification information according to semantic levels, with implementation means being multi-level structured disassembly.

[0034] Standardized desensitization rule library refers to a pre-set desensitization rule set formulated according to sensitive levels, containing different levels of processing methods, with implementation means being rule engine dynamic matching. For example: L4 level rule (house number 501 room replaced by *** room and hashed, L3 level rule (unit number 2 unit displayed as * unit), L2 level rule (building number 3# Building blurred as 2-4# Building).

[0035] Standardized desensitized data refers to data that meets privacy standards after desensitization processing, which needs to be accompanied by desensitization rule identification (records the used rules), such as the desensitization rule identification of Beijing Chaoyang District, Sunshine Community 2-4# Building Unit ** Room: L4 full desensitization of house number and L3 partial masking of unit number and L2 range blur of building number.

[0036] Two-way encryption mapping relationship refers to the two-way encryption association between unique identification and desensitized data, which can be implemented by: SM4 algorithm encryption + zero-knowledge proof verification (can verify the association but not expose the original information).

[0037] Encrypted index refers to the index structure that stores the bidirectional encrypted mapping relationship, and the implementation means is multi-level B+ tree (leaf node stores encrypted fragment, non-leaf node stores hash pointer, node with signature to prevent tampering).

[0038] Multi-dimensional compliance data refers to auxiliary data that meets regulatory requirements, such as the real estate scenario including desensitization ownership state (such as normal, mortgage), and the implementation means is differential encryption (homomorphic encryption for high sensitivity, symmetric encryption for low sensitivity).

[0039] Fusion refers to the association and integration of encrypted index and compliance data, and the implementation means is federated learning secure aggregation algorithm (protecting privacy while standardizing format).

[0040] Standardized fusion data refers to data after fusion with association score (0 to 100 points, evaluating data association) and encrypted check code.

[0041] User's identity and permission features refer to user roles, historical behavior, authentication level, and other information, including roles (intermediaries, bank risk control personnel, regulators), historical access records (query times in the past 30 days), and security levels (face recognition authentication as high level) in the real estate scenario.

[0042] Dynamic generation of access token refers to temporary permission credentials generated according to user features and data sensitivity levels, including validity period (such as 10 minutes), decryption range (such as only viewing regional average price), and operation restrictions (only query is allowed, export is not allowed), for example: the token of bank risk control personnel is valid until 10:10, and can view L3 and below data, and allow query.

[0043] Access token refers to temporary permission credentials.

[0044] Permission granularity refers to the degree of data access refinement, which is divided into field level (such as only viewing regional average price field), record level (such as viewing all desensitization fields of a certain house source), and aggregation level (such as viewing overall statistical data of a community).

[0045] Differential authorization data set refers to data set split by permission granularity, for example, the data set for intermediaries is: Sunshine Community Average Price 80,000 / square meter (aggregation level), and the data set for risk control personnel is: Sunshine Community 2-4 Building * Unit, area about 120 square meters, and ownership normal (record level).

[0046] Privacy leakage risk assessment refers to the process of assessing data access risk, and the implementation means is behavior deviation degree (compared with historical behavior) x sensitive level weighted value (L4 level 1.0, L3 level 0.7, etc.). For example, a certain intermediary suddenly queries 100 times of L4 level data, with behavior deviation degree of 80 points, risk value = 80 x 1.0 = 80 points.

[0047] Risk level refers to the risk assessment result, divided into L1 (low) to L5 (extremely high), for example, 80 points correspond to L4 level (high risk).

[0048] Privacy processing refers to the fuzzification of the risk level to avoid the disclosure of specific risk data, and the implementation means is hash processing.

[0049] The risk control system refers to a system that receives the risk level and triggers the response, such as freezing access when the risk level is L5, and warning when the risk level is L4.

[0050] The beneficial effects of the above technical solutions are: through the design of multi-source collection verification, sensitive grading, precise desensitization, encryption fusion, dynamic permission and risk control, the balance between privacy protection and data usability is realized in real estate data governance, effectively preventing information leakage, effectively solving the problems of privacy security and business demand conflict in real estate data, multi-source data fusion risk and other problems, and improving the efficiency of data governance.

[0051] The present application provides a data privacy protection method for a data governance system, step 1, comprising: According to the target object type, the collection strategy is automatically matched to form a multi-modal feature data set with a collection source identifier, wherein the target object type includes: text, audio and image; Obtain the object unique identification information measured on site, including the spatial coordinates and physical feature codes collected by the surveying equipment, and mark the anti-tampering through the blockchain timestamp; Based on the rule engine, the explicit fields and unique identification information in the multi-modal feature data set are format checked, and the fuzzy description in the feature data is associated and matched with the unique identification spatial coordinates to identify the data mode conflict; According to the conflict coefficient of the data mode conflict Trigger a secondary collection instruction to supplement the data dimension, and push the conflict data to the artificial review node; The data set that passes the verification is subjected to sensitive field preliminary masking processing, and is written into a distributed storage node after adding a collection link watermark to generate an original data set with data blood relationship markers and a preliminary judgment of security level.

[0052] In this embodiment, the text data uses a distributed crawler cluster (grabbed from a real estate platform) and OCR recognition (extracts text from pictures); the audio data uses a directional microphone (recorded on site) and a voice transcription tool (converted into text); the image data uses a drone aerial photography (building appearance) and a high-definition camera (indoor house type).

[0053] Source identification marker marks the unique identification of the data source, used to trace the collection channel, equipment and time of the data, for example, source: chain home platform, collection equipment: server ID-001, time: 2024-05-0109:30.

[0054] Multi-modal feature dataset refers to the collection formed by integrating various types of data such as text, audio, and image, containing the comprehensive features of the target object.

[0055] Field surveying refers to the process of obtaining physical information of the target object through field surveying, ensuring that the data is consistent with the actual scene.

[0056] Object unique identification information refers to the core information that can uniquely lock the target object, which is used to distinguish different housing sources in the real estate scene to avoid confusion.

[0057] Surveying equipment refers to professional equipment used for collecting spatial coordinates and physical features, such as RTK surveying instrument (acquiring centimeter-level latitude and longitude coordinates), laser scanner (measuring house size), handheld terminal (entering building unit code).

[0058] Spatial coordinates refer to the geographical latitude and longitude of the target object, used to accurately locate the housing location.

[0059] Physical feature code refers to a structured code generated according to pre-set rules to describe the physical properties of the housing, including community, building, unit, and other hierarchical information, for example, code YKXQ-02-LD05-DY03, where YKXQ represents a certain community, 02 represents the second phase, LD05 represents building 5, and DY03 represents unit 3.

[0060] Blockchain timestamp refers to the unalterable marker that writes the data collection time into the blockchain, ensuring the authenticity of the time and data, for example, the unique identification information of a certain housing is marked by the blockchain timestamp, recorded as: coordinates-code-timestamp.

[0061] Tamper-proof marker refers to a mechanism that ensures that the identification information cannot be modified arbitrarily through blockchain technology, and any modification will be recorded by the on-chain node and rejected.

[0062] Rule engine refers to an automated system of pre-set data verification rules, used to check the consistency of data format and logic in batches, and to perform real-time verification on input data through a pre-set rule library (such as area unit must be square meters, building code format is XXX-LDXX, which is set in advance).

[0063] Explicit field refers to the key information field directly presented in the data that can be directly read, such as the area in the text data: 120 square meters, the house type: 3 rooms and 2 halls, the image metadata shooting time: 2024-05-01, all of which are explicit fields.

[0064] Format check refers to checking whether the format of the explicit field meets the preset standard (such as unit, coding rule, date format, etc.).

[0065] Fuzzy description refers to the geographical or attribute information in the data that is not accurately expressed and needs to be interpreted in combination with spatial coordinates or other data correlation, such as the east gate of the cell near the subway station, a 10-minute walk from the subway station, and a large supermarket around in the audio transcription.

[0066] Correlation matching refers to associating fuzzy description with accurate spatial coordinates through algorithm and verifying its consistency, using spatial topology algorithm (such as calculating the distance between two points) and POI (point of interest) correlation model (such as matching subway station coordinates), such as comparing the fuzzy description of a 10-minute walk from the subway station with the spatial coordinate calculation of a house 1.2 kilometers away from the subway (about 15 minutes walk), finding the time deviation, and marking it as a correlation conflict.

[0067] Data pattern conflict refers to logical contradictions, inconsistent formats, and unmatched correlations within multi-source data or data.

[0068] Conflict coefficient refers to an index that quantifies the severity of data pattern conflict.

[0069] Secondary collection instruction refers to a supplementary collection instruction triggered automatically by the system when the conflict coefficient exceeds the threshold value, used to obtain missing or corrected data, such as instructing the drone to re-shoot the floor plan.

[0070] Supplementary data dimension pointer refers to supplementing missing information types or accuracy for conflict points to improve data integrity, such as supplementing the accurate coordinates of POI (such as subway station, supermarket) around the house for location fuzzy description conflict to enhance the accuracy of correlation matching.

[0071] Manual review node refers to a team or system module composed of data review personnel, responsible for processing conflict data that algorithms cannot determine, specifically: pushing conflict data to the reviewer interface through the workflow system, with conflict details (such as area conflict), and marking the processing result after the reviewer verifies the scene and data source.

[0072] The data set that passes the verification refers to the data set that meets the preset standard after format check, correlation matching, and conflict processing.

[0073] Sensitive field preliminary masking processing refers to the preliminary hiding of private information contained in the data to avoid direct disclosure, such as partial character replacement (such as mobile phone number 138****5678) and keyword fuzzification (such as ID number 110101********1234).

[0074] Collection link watermark refers to a covert mark embedded in data, recording the collection full-link information (such as equipment, time, node), used for tracing and tamper-proofing.

[0075] Distributed storage node refers to a distributed database cluster for storing data, with high availability and high expansion characteristics, such as using Hadoop Distributed File System (HDFS), storing the data set that passes the check in multiple server nodes, ensuring that data is not lost.

[0076] Data bloodline mark refers to an identification that records the full-link track of data from collection to storage (such as source, processing steps, equipment), used for tracing data flow.

[0077] Initial judgment of security level refers to the preliminary division of security level (such as L1 low sensitive, L2 medium sensitive, L3 high sensitive) according to the sensitivity of data (such as whether it contains an ID number, accurate coordinates).

[0078] Raw data set refers to the initial data set generated after the above processing, which is the basis for subsequent steps such as sensitive information classification and desensitization.

[0079] The beneficial effects of the above technical solutions are: through blockchain and watermark to ensure data authenticity and traceability, through rule engine and algorithm to accurately identify data conflicts and dynamically correct, through preliminary masking to protect core privacy, finally to generate high-quality and high-security raw data set, to lay a reliable foundation for subsequent data governance links.

[0080] The present application provides a kind of data privacy protection method for data governance system, calculates the conflict coefficient Cx of data mode conflict, comprising:

[0081] Wherein, is the total number of explicit fields; is the format error rate of the i th field; is the importance weight of the i th field, which is dynamically assigned by the rule engine based on data sensitivity; is spatial matching confidence; is the collection source credibility score; is the historical conflict times; is the total number of historical collection times; is the fine-tuning function; is the conflict times in the current preset period; is the historical average preset period conflict times of the corresponding data source; is the standard deviation of historical conflict times; is the artificial review correction coefficient of the k th conflict sample; is the time decay factor;p is the total number of conflict samples. is a conflict coefficient of the kth conflict sample; is an adaptive correction term; is a conflict outbreak coefficient; is a dynamic weight coefficient, and .

[0082] In this embodiment, The severity of the conflict of the data pattern is quantified, which is the core basis for subsequent judgment of whether to trigger secondary collection and the like, for example, is 0.8 (assuming the threshold is 0.6), which indicates that the conflict is serious and secondary collection needs to be triggered.

[0083] In this embodiment, is the security level based on the data application scenario, which adjusts the overall weight of the conflict coefficient, and the value is 1-5, for example, in the financial risk control scenario, the value of Ls is 5, at this time, is 2.32, which will significantly amplify the conflict coefficient, in the ordinary risk control scenario, the value of Ls is 1, at this time, is 0, and the dynamic weight coefficient table is as follows, such as Table 1: Table 1 Dynamic weight coefficient table

[0084] Assuming that the real estate data contains: house area, property owner name, and house address, at this time, the value of n is 3.

[0085] In this embodiment, The value range of is 0 to 1, that is, the deviation degree of the display field from the preset format standard, which is regarded as the format error rate.

[0086] In this embodiment, The value range of is 0 to 1, and For example, the value of of the property owner name is 0.5, the value of of the house area is 0.3, and the value of of the house address is 0.2.

[0087] In this embodiment, The value range of is 0 to 1, that is, the confidence degree of the spatial coordinates of the fuzzy description and the unique identifier in the feature data after the spatial topology algorithm matching.

[0088] In this embodiment, The value range of is 0 to 1, that is, the credibility score of the collection source (such as a crawler cluster, an Internet of Things terminal, etc.) of the multi-modal feature data, which is based on historical data accuracy, compliance authentication, and the like pre-configuration.

[0089] ​​​In this embodiment, the data sources in data governance are diverse and the scenes are complex, and a single conflict judgment method (such as only looking at format errors) cannot meet the demand for accurate conflict identification. The formula can more accurately reflect the real situation of the conflict by weighting and dynamically adjusting multiple factors, and is a key technical means to realize high-quality data governance.

[0090] In this embodiment, when calculating the conflict coefficient of the data mode conflict, the result of manual review is introduced to correct the conflict coefficient calculated based on the algorithm. When the manual judgment is correct conflict, a certain weight +0.1 is added to strengthen the influence of the conflict in the overall evaluation; when the judgment is a misjudged conflict, the weight is reduced by-0.1 to weaken the interference of the wrong judgment on the subsequent decision (such as whether to trigger secondary collection), so that the conflict coefficient is more in line with the actual situation, and the accuracy of data conflict identification is improved.

[0091] The beneficial effects of the above technical solution are: by calculating the conflict coefficient by comprehensively considering multiple factors (format, space, source, history, real-time conflict trend, manual review correction, etc.), the degree of data mode conflict can be accurately quantified, and a scientific basis can be provided for subsequent operations such as whether to trigger secondary collection and manual review, thereby effectively improving the accuracy and dynamic adaptability of conflict identification in data governance, and ensuring data quality and privacy security.

[0092] The present application provides a data privacy protection method for a data governance system, and an additional collection link watermark, comprising: Determine the collection work attribute of the collection node, and match the first string of the first length and the second string of the second length from the node-watermark table according to the node number of the collection node; Capture the custom string of the collection node, and determine the character length range in combination with the real-time collection attribute of the collection node; Randomly select a character length from the character length range, and perform splicing processing after performing truncation processing or padding processing on the first length and the second length to obtain a first new segment; Determine the hidden position of each collection type involved in the data set that passes the verification respectively; Construct a timestamp-type pair of the data set that passes the verification to obtain a data collection track, wherein the timestamp-type pair is a combination of the collection data types of the data set that passes the verification at each data collection time; Determine the highlight point set of the data collection track, and lock the first position of the minimum highlight point, the second position of the two highlight points farthest from the minimum highlight point in the highlight point set, and the third position of the two highlight points with the maximum absolute value difference from the minimum highlight point; The first intermediate point of the second position, the second intermediate point of the third position, and the minimum protruding point are configured to form an output shape, wherein the output shape is a straight line shape or a triangular shape; According to the time coverage length of each collection type, the output shape is proportionally extracted to obtain a new shape, and a function of the new shape is constructed; According to the position size of the hidden position and the position allowed deviation relationship, and in combination with the hardware fingerprint of the collection node, the collection timestamp, the data type identifier, and the link feature code generated by the feature hash value of the original data and the function of the new shape, an additional segment of each collection type is obtained. The first new segment and the additional segment are combined to obtain a sub-watermark corresponding to the collection type, and then a collection link watermark is obtained.

[0093] The collection node refers to a hardware or software unit that performs data collection tasks, including crawler servers (collecting real estate platform data), drones (shooting building images), handheld mapping terminals (recording physical characteristics of houses), etc.

[0094] The collection work attribute refers to the core function and task type of the collection node, which is used to distinguish the work range of the node, such as real-time text data capture, timed image data capture, and offline physical feature code entry. The node number is a unique identification code assigned to each collection node, which is used to locate the node identity.

[0095] The node-watermark table is a database that pre-stores the correspondence between the node number and the basic watermark string, which is used to quickly match the initial watermark material exclusive to the node. For example, the table records SP-001: first string A7B3K9 (length 6), second string X2Y5Z1 (length 6); TP-002: first string C1D8E2 (length 6), second string F4G6H3 (length 6).

[0096] The custom string is a personalized identifier set by the user for the collection node, which is used to supplement the node features (such as node purpose, team affiliation), such as setting the custom string Fangyuan_Spider for the SP-001 node (identifying its use for house text capture).

[0097] The real-time collection attribute refers to the current work state parameter of the collection node, including the collection frequency (such as 3 times per minute), the data type proportion (such as 80% for text), the network stability (such as signal strength 90%), etc.

[0098] The character length range is dynamically determined according to the length of the custom string and the real-time collection attribute, and the length of the subsequent processing string (to ensure the dynamic nature of the watermark length and avoid fixed patterns), and the acquisition method is as follows:

[0099] wherein, is the custom string length of the collection node, is the real-time collection frequency level, quantified as 1 to 5, is the real-time network stability score, quantified as 0 to 100, 100 indicating network stability, is the floor symbol; is the ceiling symbol.3、30 is to avoid insufficient watermark information due to too short length, or process affecting concealment.

[0100] The truncation processing is an operation of retaining the first N bits (N is the selected length) when the original length of the first / second string exceeds the selected character length, for example, the selected character length is 5, and the first string G2H5J1 (length 6) is truncated to G2H5J.

[0101] The padding processing is an operation of supplementing to the selected length with a preset filler 1 when the original length of the first / second string is less than the selected character length.

[0102] The splicing processing is an operation of combining the truncated / padded first string and the second string in order to form a new string, which is the first new segment.

[0103] The data set that passes the verification refers to a multi-modal data set (such as a house source data containing text, image, and audio) that meets the standard after format verification and conflict processing.

[0104] The hidden position refers to the specific position of the watermark embedded in different types of data, specifically: the text type selects the position of the virtual word (such as "of " "in" and other words that do not affect the semantics); the image type selects the low-frequency pixel area (low-frequency coefficients after DCT transformation, which does not affect the visual effect); the audio type selects the phase spectrum (phase information that does not affect the auditory effect), for example, the hidden position of the text type data is the third "of " word; the hidden position of the image type data is the 10x10 low-frequency area at the lower left corner of the house type diagram.

[0105] The timestamp-type pair is a key-value pair composed of the data collection time (timestamp) and the data type collected at the corresponding time, recording the association between the collection time and content, for example, timestamp 1: text+image, timestamp 2: audio.

[0106] The data collection trajectory is a sequence formed by arranging multiple timestamp-type pairs in chronological order, reflecting the collection process and type change of the target object data.

[0107] The highlight point set refers to the key time points with significant characteristics in the data collection track. It is usually the time when the collection amount changes abruptly (increases / decreases), the type switches frequently, or the collection interval is abnormal. It is identified by an anomaly detection algorithm (such as Z-score). For example, if the collection amount is more than twice the average value at a certain time, or the type switching frequency is ≥3 times per hour, such as in a certain track, the collection amount is 10 at 09:30 (normal), 50 at 10:00 (abrupt increase), and 5 at 11:00 (abrupt decrease), then the highlight point set is 10:00 and 11:00.

[0108] The minimum highlight point is the time point with the smallest collection amount or the lowest importance in the highlight point set. For example, in the highlight point set 10:00 (50) and 11:00 (5), 11:00 is the minimum highlight point.

[0109] The first position is the timestamp corresponding to the minimum highlight point.

[0110] The second position is the two time points in the highlight point set that are farthest apart in space (time difference) from the minimum highlight point.

[0111] The third position is the two time points in the highlight point set with the largest absolute value of the collection amount difference from the minimum highlight point.

[0112] The first intermediate point is the middle time of the two time points in the second position.

[0113] The second intermediate point is the middle time of the two time points in the third position.

[0114] The output shape four is a geometric shape (straight line if the three points are collinear, otherwise triangle) with the first intermediate point, the second intermediate point, and the minimum highlight point as vertices.

[0115] The time coverage length is the proportion of the time length of a certain collection type in the total collection time (reflecting the importance of the data of that type).

[0116] The new shape is extracted in proportion to the output shape according to the time coverage length (the proportion is the time coverage length), ensuring that the new shape matches the importance of the collection type. For example, the output shape is a triangle (base length 4 hours), and the text type has a time coverage length of 0.5. The new shape base length = 4 x 0.5 = 2 hours.

[0117] The function of the new shape is a mathematical expression describing the boundary or characteristics of the new shape (for easy embedding of watermarks later). For example, if the new shape is a straight line, the expression is y = 0.5x + 2 (x is time, y is collection amount); if the new shape is a triangle, the expression is the straight line equation of its three sides.

[0118] Position size is the physical size of the hidden position in the data (such as the character position sequence number in the text, the pixel area size in the image), for example, the text type hidden position is the 5th character (position size is 5); the image type hidden position is a 20x20 pixel area (position size is 400 pixels).

[0119] Position allowable deviation relationship is the error range that the hidden position can allow (to avoid watermark loss due to slight changes in data), for example, the text type hidden position allows ±1 character deviation; the image type allows ±2 pixel deviation.

[0120] Hardware fingerprint is the unique physical identifier of the collection node (such as device MAC address, CPU serial number), and data type identifier is the code that distinguishes data types (such as TXT represents text, IMG represents image).

[0121] The feature hash value of the original data is a unique value generated by a hash algorithm (such as SHA-256) on the original data (such as house text, house plan), which is used to verify data integrity, for example, the feature hash value of the house plan is a3b7c9d1.

[0122] Link feature code is a 128-bit code generated by combining hardware fingerprint, collection timestamp, data type identifier, and feature hash value (unique identifier of data collection link), for example, the link feature code is SM3(HW+TS+TYPE+HASH)=f2e4d6c8.

[0123] Additional fragment is a watermark fragment generated by combining hidden position parameters, link feature code, and new shape function, which is bound to the collection type (supplement the uniqueness of the first new fragment), for example, the text type additional fragment is: f2e4d6c8_09:30_TXT (embedded link feature code, timestamp, type identifier).

[0124] Change combination is to combine the first new fragment and the additional fragment according to dynamic rules (such as random order splicing, cross character insertion), to avoid fixed watermark pattern, for example, the first new fragment G2H5JL3M11 is cross-inserted with the additional fragment f2e4d6c8_09:30_TXT, to obtain G2f2H5e4JLd63Mc811_09:30_TXT.

[0125] Sub-watermark is a watermark generated for a single collection type (text / image / audio), which adapts to the hidden position of this type of data.

[0126] Collection link watermark is a watermark formed by integrating all sub-watermarks of collection types, which covers the entire link (can trace the collection node, time, device, and data integrity).

[0127] The beneficial effects of the above technical scheme are: through dynamic string processing, trajectory feature extraction, multi-dimensional information fusion to generate a collection link watermark, the watermark not only contains node inherent properties, but also integrates real-time collection state and process trajectory, realizing full-link protection of real estate data, and through the hidden position and dynamic combination rule of multi-type data adaptation, the watermark hiding property and anti-cracking ability are balanced, reliable technical support is provided for traceability and anti-counterfeiting in data governance.

[0128] The application provides a data privacy protection method for a data governance system, step 2, comprising: The original data set is subjected to multi-modal analysis, and the analysis results of different data types are subjected to sensitive marking based on a pre-constructed sensitive word library, and at the same time, the spatial coordinate association information of different data types is obtained; The spatial coordinate association information is analyzed based on a spatial association rule library, and implicit sensitive data with geographical correlation in the sensitive area of the sensitive marking is identified; The basic sensitivity of a single sensitive field in the implicit sensitive data is multiplied by the combination risk coefficient between the fields to obtain a comprehensive sensitivity value; The comprehensive sensitivity value is dynamically adjusted in combination with the data timeliness feature, and a sensitive level label is mapped to obtain preprocessed data with a level label.

[0129] In this embodiment, multi-modal analysis refers to the process of extracting key information by using adaptive analysis technology for different types of data (text, image, audio), such as extracting keywords (such as owner's name, phone number) by natural language processing (NLP) for text, identifying objects (such as house number, house structure) by object detection algorithm (such as YOLO) for images, and converting text by speech transcription technology (such as ASR) for audio.

[0130] The pre-constructed sensitive word library refers to a database that pre-stores privacy sensitive keywords and rules for quickly identifying sensitive information, and is classified into personal information (such as ID number, mobile phone number), spatial sensitive (such as house number, military area), and business sensitive (such as mortgage, seal).

[0131] Sensitive marking refers to marking information containing sensitive word library keywords in the analysis result with a preset label (such as personal sensitive, spatial sensitive), and clearly marking the location of sensitive information, for example, the marked analysis result is: owner's name: Zhang San (personal sensitive), contact number: 138****5678 (personal sensitive); house number: 501 (spatial sensitive); location description: near the military area (spatial sensitive).

[0132] Spatial coordinate association information refers to the mapping relationship between different data types and geographic coordinates, which is used to locate the physical position corresponding to the data. For example, the coordinates can be obtained by matching the address keywords (such as a certain community No. 3 building) in the text with the GIS geographic library, or by extracting the coordinates from the GPS information captured by the image.

[0133] Spatial association rule base refers to a database that stores geographic association rules, which is used to determine the spatial relationship (such as distance, inclusion relationship) between data coordinates and sensitive areas. For example, the rule base contains: sensitive area: XX military region, coordinate range (116.42°-116.43°, 39.9°-39.91°), association threshold: within 500 meters - mark implicit sensitivity.

[0134] Sensitive marked sensitive area refers to a pre-defined geographic area that needs to be protected (such as a military management area, a private residential area, and a confidential unit), which has been marked and stored in the system.

[0135] Geographic relevance refers to the spatial relationship (such as distance less than threshold, located within the area) between the spatial coordinates of data and the coordinates of sensitive areas, which is calculated by the spatial distance formula (such as Haversine formula).

[0136] Implicit sensitive data refers to data that does not contain explicit sensitive words, but has privacy risks due to strong geographic relevance with sensitive areas.

[0137] Single sensitive field in implicit sensitive data refers to an information unit with independent meaning in implicit sensitive data, such as community name, building number, and house number in address.

[0138] Basic sensitivity refers to the inherent sensitivity of a single sensitive field (based on the privacy risk that may be caused after its leakage), with a value range of 0-1 (the higher the value, the higher the risk), which is preset by the sensitive word library.

[0139] Combination risk coefficient between fields refers to the coefficient of amplification of privacy risk caused by information complementation after the combination of multiple sensitive fields, with a value ≥ 1 (the more specific the combination, the higher the coefficient), which is dynamically calculated by the rule engine based on field association, specifically:

[0140] where, represents the total number of sensitive fields participating in the combination; represents the sensitivity level weight of the u1th sensitive field; represents the semantic association degree between the u1th field and the u2th field, with a value of 0 to 1.

[0141] The comprehensive sensitivity value is a product of the base sensitivity of a single sensitive field and a combination risk coefficient, quantifying the actual sensitivity of the field in a combination scenario.

[0142] The data timeliness feature refers to a difference between a data collection time and a current time, reflecting the freshness of the data (usually, higher privacy risk of new data, and risk decay of old data over time).

[0143] The dynamic adjustment of the comprehensive sensitivity value is weighted correction of the comprehensive sensitivity value according to the data timeliness feature (a new data weighting coefficient > 1, and an old data weighting coefficient < 1).

[0144] The sensitive level label is mapping of the adjusted comprehensive sensitivity value to a preset level (such as L1-L4, L1 being the lowest, and L4 being the highest), and is used for intuitive identification of the data sensitivity.

[0145] The mapping rule is: 0-0.5 corresponds to L1; 0.5-1.0 corresponds to L2; 1.0-2.0 corresponds to L3; and > 2.0 corresponds to L4.

[0146] The preprocessed data refers to structured data with the added sensitive level label, is an input of subsequent desensitization processing, and includes field content, a comprehensive sensitivity value and a sensitive level label.

[0147] The beneficial effects of the above technical solution are: sensitive information in multiple types of data is accurately extracted through multi-modal analysis, implicit sensitive data (such as house information associated with a sensitive area) is identified in combination with spatial correlation rules, the comprehensive sensitivity is dynamically calculated through the base sensitivity, the combination risk and the timeliness, and finally the preprocessed data with the level label is generated, which provides a precise basis for subsequent graded desensitization, and improves the fine degree of real estate data privacy protection.

[0148] The present application provides a data privacy protection method for a data governance system, and step 3 comprises: Multi-level semantic disassembly is performed on core identification information in the preprocessed data to obtain a disassembly component type and a sensitive level label of each core identification information; A basic desensitization rule consistent with the disassembly component type and the sensitive level label is matched from a pre-constructed standardized desensitization rule library, and local data associated with the corresponding core identification information is desensitized to generate standardized desensitized data with a desensitization rule identifier.

[0149] In this embodiment, for example, the core identification information: Beijing Chaoyang District, a certain community, 3# building, 2# unit, 501# room is disassembled as: First level: administrative division (Beijing Chaoyang District); Second level: community name (a certain community); Third level: building number (3# building); Fourth level: unit number (2 units); Fifth level: door number (501 room); The disassembled component type refers to the category of each structured component obtained after multi-level semantic disassembly, used to distinguish the information attributes of different levels, for example, the sensitive level label of the disassembled component is: Administrative division (Chaoyang District, Beijing): L1 (low sensitivity, only identifies the region and cannot locate specific housing); Community name (certain community): L2 (low-medium sensitivity, can locate the community but the range is wide); Building number (Building 3): L3 (medium-high sensitivity, can be narrowed down to a specific building); Unit number (2 units): L3 (medium-high sensitivity, further narrowing the range); Door number (501 room): L4 (extremely high sensitivity, can accurately locate the housing); The pre-built standardized desensitization rule library refers to a set of desensitization rules that are pre-set and classified by disassembled component type and sensitive level label, containing specific processing methods in different scenarios, ensuring standardized and reusable desensitization process, as shown in Table 2: Table 2: Rule library example (real estate scenario) Disassembly component type Sensitive level Desensitization rule description Administrative division L1 Complete reservation (such as Chaoyang District, Beijing) Cell name L2 Complete reservation (such as a certain cell) Building number L3 Scope fuzzing (such as Building 3 -> Building 2-4) Unit number L3 Partial mask (such as Unit 2 -> * Unit) Door number L4 Full mask (such as Room 501 -> *** Room) Identity card number L4 Middle 10-bit mask (such as 1101011234 -> 1101011234) The basic desensitization rule refers to the specific desensitization rule that matches the disassembled component type and sensitive level label from the standardized desensitization rule library, which is the basis for desensitization processing.

[0150] The local data associated with the corresponding core identification information refers to the specific content in the core identification information corresponding to a certain disassembled component, i.e., the target fragment that needs to be desensitized, for example, the local data associated with the door number component in the core identification information Beijing Chaoyang District, certain community, Building 3, Unit 2, 501 room is 501 room.

[0151] Desensitization processing refers to the process of applying basic desensitization rules to the local data for privacy protection processing, reducing information sensitivity through replacement, fuzzification, masking, etc., while retaining necessary business usability.

[0152] Desensitization rule identifier refers to a unique code that records the desensitization rule used by the local data, used to trace the desensitization logic (such as rule source, processing method), ensuring that the desensitization process is auditable.

[0153] Standardized desensitization data refers to the final data after desensitization processing, with uniform format, conforming to privacy protection standards and additional desensitization rule identifier, protecting privacy while retaining the basic information required by the business.

[0154] The beneficial effects of the above technical solutions are: through multi-level semantic disassembly of core identification information, fine splitting of sensitive information is realized, and a standardized desensitization rule library is combined to accurately match a desensitization strategy, while the privacy of a high-sensitive component is protected, the availability of a low-sensitive component is reserved, and finally, the generated standardized desensitization data meets the privacy protection requirements, and lays a reliable foundation for subsequent data fusion and access control.

[0155] The application provides a data privacy protection method for a data governance system, step 4, comprising: Obtaining field-collected object unique identification information for encryption processing and obtaining standardized desensitization data for hash processing; Based on the encrypted identification information and the hash-processed desensitization data, a dynamic mapping table is constructed, wherein the encrypted digest of the identification information is taken as the primary key, and the hash value of the standardized desensitization data is taken as the value, to form a basic mapping relationship; Based on the basic mapping relationship, an encrypted index is generated, wherein the leaf node of the index stores the encrypted fragment of the basic mapping relationship, the non-leaf node stores the hash pointer of the fragment position, and each level of node is additionally attached with a time stamp and a node signature; The ownership status data, the regional average transaction data and the historical risk marking data processed by the desensitization are differentially encrypted according to the sensitivity level; The associated data fragments are located through the hash pointer in the index, the secure aggregation algorithm is used to perform format standardization processing on the fused data, and the standardized fused data with a data correlation score and an encrypted check code is generated, wherein the data correlation score is dynamically calculated based on the spatial correlation and the time consistency of the identification information and the compliance data.

[0156] In this embodiment, the national SM4 symmetric encryption algorithm (suitable for reversible scenarios, such as subsequent identification verification) is used to segmentally encrypt the coordinates and the code. The SHA-256 hash algorithm is used to calculate the desensitization data.

[0157] The dynamic mapping table refers to a database table that can be updated in real time and stores the association relationship between the encrypted identification and the hash value of the desensitization data, supports adding, deleting and modifying the mapping relationship, and adapts to the dynamic change of data. For example, the table structure is: encrypted identification digest | desensitization data hash value. When the desensitization data is updated, the corresponding hash value in the table is automatically updated synchronously.

[0158] The encrypted digest of the identification information refers to the digest value obtained by further hashing the encrypted identification information, the primary key refers to a field for uniquely identifying a record in the dynamic mapping table, and is used for quickly querying the mapping relationship. Here, it is the encrypted digest of the identification information.

[0159] The basic mapping relationship refers to the association relationship between the encrypted identification digest (primary key) and the hash value of the desensitization data (value).

[0160] Encryption index refers to the encryption index structure designed specifically for spatially related data (such as house information containing coordinates), used to quickly locate data segments related to spatial location while protecting the security of the index itself.

[0161] Leaf node refers to the lowest level node in the index structure, which directly stores the actual data segment (here, the encrypted segment of the basic mapping relationship).

[0162] Non-leaf node refers to the upper layer node in the index structure other than the leaf node, which does not directly store data but stores pointers to child nodes (next level nodes) for index navigation.

[0163] Hash pointer refers to the hash value stored in the non-leaf node, which points to the location of the child node, and also verifies that the child node has not been tampered with.

[0164] Node signature refers to the digital signature generated by signing the node content (including data segment, hash pointer, and timestamp) with the private key of the collection node, used to verify the authenticity (not forged) and integrity (not tampered) of the node content.

[0165] Differential encryption refers to the use of different encryption algorithms with different strengths according to the sensitivity level (L1-L4) of the data, balancing security and computational efficiency.

[0166] Hash pointer positioning refers to the process of navigating through the hash pointers of non-leaf nodes in the encryption index to find the de-identified data hash value and compliance data segment associated with the target identification information, such as locating the child node through hash pointer K3%7L...8M and finally finding the corresponding de-identified data and ownership status data for F2$4H...6J.

[0167] Secure aggregation algorithm refers to an algorithm that integrates and calculates multi-source data (such as de-identified data, ownership status, and transaction data) while protecting data privacy, ensuring that original data is not leaked during aggregation, using the SecureAggregation algorithm in federated learning.

[0168] Format standardization processing refers to converting the aggregated multi-source data into a unified format (such as JSON structure), ensuring consistency in data fields, units, and coding rules, facilitating subsequent use.

[0169] Data correlation score refers to an index (0-100 points) that quantifies the closeness of the association between identification information and compliance data, based on spatial correlation (such as the matching degree of house coordinates and area) and temporal consistency (such as the overlap degree of transaction data time and collection time).

[0170] The encryption check code refers to a check value generated by using a hash algorithm on the standardized fusion data, and is used to verify whether the data is tampered in the transmission or storage process.

[0171] The technical scheme has the beneficial effects that the original information privacy is protected by encryption and hash processing, the accuracy of data association is ensured by index and correlation score, and the standardized fusion data finally generated lays a reliable foundation for subsequent data access control and risk assessment.

[0172] The application provides a data privacy protection method for a data governance system, and the method comprises the following steps: Based on the permission parameter in the access token and the preset permission-sensitivity level mapping matrix, the standardized fusion data is granularly split to form a differentiated authorization data set divided by field level-record level-aggregation level permission granularity; The access trigger parameters of the differentiated authorization data set are collected, compared with the user behavior baseline library, the behavior deviation degree is calculated, the initial risk value is generated in combination with the sensitivity level weighting value of the data set, and the risk level is obtained.

[0173] In this embodiment, the access token refers to a temporary permission certificate generated based on a three-dimensional dynamic weight model, which contains information such as permission validity period (such as 10 minutes), accessible sensitivity level (such as L2-L4), operation restriction (such as only query, not exportable), and built-in dynamic check code (refreshed every 5 minutes).

[0174] The permission parameter refers to a specific permission rule defined in the access token, including the accessible sensitivity level range (such as L2 and above), the data operation type (query / export / modify), and the permission effective period (such as 9:00-18:00 on weekdays), for example, the permission parameter is the sensitivity level range: L2-L4; the operation type: query; and the effective period: 9:00-18:00.

[0175] The permission-sensitivity level mapping matrix refers to a preset corresponding relationship table of user permissions and data sensitivity levels, which clearly defines the sensitivity levels and processing methods that can be accessed by different permissions, as shown in Table 3 (partly): Table 3: Permission-sensitivity level mapping matrix User authority Accessible sensitive level Processing method Real estate agent L1-L2 Aggregated level data (such as average price in the area) Bank risk control personnel L2-L4 Record level data (such as desensitization details of a single house source) Government regulators L1-L4 Field level data (can view some original fields) In this embodiment, the granular split refers to splitting the standardized fusion data into fragments of different levels of detail according to the permission parameters, to ensure that the user can only access the data within the permission range, which is realized based on the field splitting algorithm (extracting the fields conforming to the permission), the record filtering (screening single records), and the aggregation calculation (summarizing statistical data).

[0176] In this embodiment, the field-level-record-level-aggregation-level permission granularity: Field level: Allow access to a single or multiple specific fields in the data (such as viewing only the ownership status field), the granularity is the finest.

[0177] For example: regulatory personnel can access the ownership status: in mortgage field.

[0178] Record level: Allow access to a single complete record (including multiple fields, but all are de-identified content), the granularity is medium.

[0179] Aggregation level: Only allow access to the statistical results of multiple records (such as the average price of housing in the region, the total number), the granularity is the coarsest.

[0180] Differential authorization data set refers to the exclusive data set generated for a specific user after being split according to different permission granularity, which only contains information within its permission range.

[0181] Access trigger parameter refers to the behavior characteristics of the user when accessing the differential authorization data set, including access time period (such as 2:00 in the morning), terminal IP attribution (such as unusual regions), operation frequency (such as 50 queries in 1 minute), and operation type (such as frequent export).

[0182] User behavior baseline library refers to the baseline data set that records the user's normal access behavior, including historical average access time period (such as 9:00-18:00), average operation frequency (such as 5 times per hour), and commonly used terminal IP, etc., which is used to judge whether the current behavior is abnormal.

[0183] Behavior deviation degree refers to the difference between the current access trigger parameter and the user behavior baseline, with a value of 0-100 points (the higher the score, the more abnormal the behavior).

[0184] The sensitivity level weighting value of the data set refers to the risk weight given according to the sensitivity level contained in the differential authorization data set (L1=0.2, L2=0.4, L3=0.7, L4=1.0), the higher the sensitivity level, the greater the weighting value.

[0185] Initial risk value refers to the product of behavior deviation degree and sensitivity level weighting value, which quantifies the risk degree of access behavior, initial risk value = behavior deviation degree × sensitivity level weighting value, for example, an intermediary accessing L2 level data (weighting value 0.4), behavior deviation degree 100 points, initial risk value is 40.

[0186] Risk level refers to the risk degree identification according to the initial risk value, which is usually divided into L1 (low risk, 0-20 points), L2 (low-medium risk, 21-40 points), L3 (medium risk, 41-60 points), L4 (high risk, 61-80 points), and L5 (extremely high risk, 81-100 points).

[0187] The beneficial effects of the above technical scheme are: different authorization data is generated by granularity splitting of permissions, and the risk level is calculated by weighting the behavior deviation degree and the sensitive level, so that different role users can obtain data on demand, and abnormal access can be identified in real time, the balance between data privacy protection and business availability is effectively achieved, the security and controllability of data access are improved, and the governance efficiency is further improved.

[0188] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A data privacy protection method for a data governance system, characterized in that, include: Step 1: Obtain multi-source feature data of the target object based on the multi-source acquisition module, cross-validate it with the unique identification information of the object collected in the field, and generate the original dataset; Step 2: Based on the original dataset, identify and classify sensitive information to generate preprocessed data with sensitivity level labels; Step 3: Decompose the core identification information in the preprocessed data and match it with the pre-built standardized de-identification rule library to generate standardized de-identified data that complies with privacy protection; Step 4: Establish a two-way encrypted mapping relationship between the unique identification information of the objects collected on-site and the standardized de-identified data to form an encrypted index. Then, integrate the encrypted index with the preset multi-dimensional compliant data to generate standardized fused data. Step 5: Dynamically generate access tokens based on standardized fused data and user identity and permission characteristics. Based on the access tokens, generate differentiated authorization datasets divided by permission granularity to conduct privacy leakage risk assessment and generate risk levels. After privacy processing of the risk levels, output them to the risk control system.

2. The data privacy protection method for a data governance system according to claim 1, characterized in that, Step 1 includes: The collection strategy is automatically matched according to the target object type to form a multimodal feature dataset with collection source identification. The target object types include: text, audio and image. Obtain the unique identifier information of the object being surveyed on-site, including the spatial coordinates and physical feature codes collected by surveying equipment, and mark them with blockchain timestamps to prevent tampering. Based on the rule engine, the explicit fields and unique identifiers in the multimodal feature dataset are formatted and validated. The fuzzy descriptions in the feature data are associated and matched with the spatial coordinates of the unique identifiers to identify data pattern conflicts. Based on the conflict coefficient of data pattern conflicts Trigger a secondary data collection command to supplement data dimensions, and at the same time, push conflicting data to the manual review node; The dataset that passes the verification is initially masked for sensitive fields, and after adding a watermark from the acquisition link, it is written to a distributed storage node to generate an original dataset with data lineage markings and a preliminary security level assessment.

3. The data privacy protection method for a data governance system according to claim 2, characterized in that, The conflict coefficient Cx for calculating data pattern conflicts includes: ； in, Total number of explicit fields; Let be the format error rate of the i-th field; The importance weight of the i-th field is dynamically assigned by the rule engine based on data sensitivity. Spatial matching confidence; Assess the credibility of the data collection source; Number of historical conflicts; This represents the total number of historical data collections. This is a fine-tuning function; This represents the number of conflicts within the current preset time period. The historical average number of conflicts for the corresponding data source is preset for a specific time period; The standard deviation of the number of historical conflicts; The manual verification correction coefficient for the k-th conflicting sample; p is the time decay factor; p is the total number of conflicting samples; Let be the conflict coefficient of the k-th conflicting sample; For adaptive correction terms; The conflict outbreak coefficient; These are dynamic weighting coefficients, and .

4. The data privacy protection method for a data governance system according to claim 2, characterized in that, Additional watermarks are added to the data collection process, including: Determine the data collection attributes of the data collection node, and match the first string of the first length and the second string of the second length from the node-watermark lookup table according to the node number of the data collection node; Capture the custom string for the acquisition node, and determine the character length range by combining the real-time acquisition attributes of the acquisition node; Randomly select a character length from the character length range, and perform truncation or padding on the first length and the second length before splicing to obtain the first new segment; Determine the hidden location for each acquisition type involved in the verified dataset; Construct timestamp-type pairs for the validated dataset to obtain the data acquisition trajectory, wherein the timestamp-type pairs are the combination of the data types acquired at each data acquisition time for the validated dataset; Determine the set of prominent points of the data acquisition trajectory, and lock the first position of the minimum prominent point, the second positions of the two prominent points in the set of prominent points that are farthest from the minimum prominent point, and the third positions of the two prominent points with the largest absolute value of the difference from the minimum prominent point; The first midpoint of the second position, the second midpoint of the third position, and the minimum protrusion point are used to construct an output shape, wherein the output shape is a straight line shape or a triangle shape; Based on the time coverage length of each acquisition type, a new shape is extracted proportionally from the output shape, and a function for constructing the new shape is generated. Based on the location size and allowable deviation of the hidden location, and combined with the hardware fingerprint of the acquisition node, acquisition timestamp, data type identifier, and feature hash value of the original data to generate the link feature code and the new shape function, additional fragments for each acquisition type are obtained. The first new segment and the additional segment are combined and modified to obtain the sub-watermark of the corresponding acquisition type, and then the acquisition link watermark is obtained.

5. The data privacy protection method for a data governance system according to claim 1, characterized in that, Step 2 includes: Multimodal parsing is performed on the original dataset, and sensitive labeling is applied to the parsing results of different data types based on a pre-built sensitive word library. At the same time, information on the association between different data types and spatial coordinates is obtained. Based on the spatial association rule base, analyze spatial coordinate association information to identify implicit sensitive data that has a geographical association with sensitive areas marked by sensitive data; The overall sensitivity value is obtained by multiplying the basic sensitivity of a single sensitive field in the implicit sensitive data by the combined risk coefficient between the fields. By dynamically adjusting the comprehensive sensitivity value based on the timeliness characteristics of the data and mapping it to obtain sensitivity level labels, preprocessed data with level labels is generated.

6. The data privacy protection method for a data governance system according to claim 1, characterized in that, Step 3 includes: Multi-level semantic decomposition is performed on the core identification information in the preprocessed data to obtain the decomposed component type and sensitivity level label of each core identification information; The system matches and de-identifies the basic de-identification rules that are consistent with the component type and sensitivity level labels from the pre-built standardized de-identification rule library, performs de-identification processing on the local data associated with the corresponding core identification information, and generates standardized de-identified data with de-identification rule labels.

7. The data privacy protection method for a data governance system according to claim 1, characterized in that, Step 4 includes: The unique identifier information of the objects collected on-site is encrypted, and the standardized de-identified data is hashed. Based on the encrypted identification information and the hashed desensitized data, a dynamic mapping table is constructed, in which the encrypted digest of the identification information is used as the primary key and the hash value of the standardized desensitized data is used as the value to form a basic mapping relationship. An encrypted index is generated based on the basic mapping relationship. The leaf nodes of the index store encrypted fragments of the basic mapping relationship, and the non-leaf nodes store hash pointers to the fragment positions. Each level of node is also appended with a timestamp and node signature. The ownership status data, regional average transaction data, and historical risk marker data, after being anonymized, are encrypted using differentiated encryption methods based on their sensitivity levels. The associated data fragments are located by hash pointers in the index, and the fused data is format-standardized by a secure aggregation algorithm to generate standardized fused data with data relevance scores and encrypted verification codes. The data relevance scores are dynamically calculated based on the spatial relevance and temporal consistency between the identification information and the compliant data.

8. The data privacy protection method for a data governance system according to claim 1, characterized in that, Step 5 includes: Based on the permission parameters in the access token and the preset permission-sensitivity level mapping matrix, the standardized fused data is granularly split to form a differentiated authorization dataset divided by field-level, record-level, and aggregation-level permission granularity. Access trigger parameters of the differentiated authorization dataset are collected, compared with the user behavior baseline library, the behavior deviation is calculated, and an initial risk value is generated by combining the sensitivity level weighted value of the dataset, and the risk level is obtained.

Images