Data processing method, system, and storage medium

Abstract

The present disclosure provides a data processing method, system and storage medium, relating to the field of industrial data processing. The method comprises: classifying a plurality of elements in a data set into a plurality of sub-sets according to element attribute information, each sub-set comprising elements of the same category; matching each sub-set with a corresponding protection strategy to obtain a strategy set; and fusing a plurality of protection strategies in the strategy set according to the association relationship between the protection strategies to obtain a fused protection strategy, and using the fused protection strategy to perform protection processing on the data set. The present disclosure makes the data processing process closer to actual needs and usage habits, meets the individual needs of industrial data, and thus improves the ability of data protection processing.

Description

Technical Field

[0001] This disclosure relates to the field of industrial data processing, and more particularly to a data processing method, system, and storage medium. Background Technology

[0002] In the digital age, the establishment of industrial data spaces in key industries and the guidance of orderly data sharing and circulation are in their initial stages of development. Based on practical experience in data sharing and the consumer internet, an industrial data sharing and circulation framework has been constructed.

[0003] However, the relevant technologies are all designed for processing holistic data, meaning the data has a simple internal structure and all parts have consistent security requirements without differentiation. In reality, the level of informatization in the industrial sector varies greatly, and the data circulating between enterprises is diverse in form and complex in composition. The relevant technologies cannot meet the security protection needs of complex and non-holistic data, thus limiting their application in the industrial field. Summary of the Invention

[0004] One technical problem this disclosure aims to solve is to provide a data processing method, system, and storage medium that can meet the personalized needs of industrial data, thereby improving the ability to protect and process data.

[0005] According to one aspect of this disclosure, a data processing method is proposed, executed by a data processing system, comprising: classifying multiple elements in a data set into multiple subsets according to element attribute information, each subset including elements of the same category; matching each subset with a corresponding protection strategy to obtain a strategy set; and merging multiple protection strategies in the strategy set according to the correlation between the protection strategies to obtain a merged protection strategy, and using the merged protection strategy to perform protection processing on the data set.

[0006] In some embodiments, the relationship between protection strategies includes one of mutual exclusion, complementary, and unrelated strategies.

[0007] In some embodiments, merging multiple protection strategies in the strategy set includes: if at least two protection strategies in the strategy set are mutually exclusive, then the protection strategy with higher priority among the at least two protection strategies is used as the merged protection strategy.

[0008] In some embodiments, fusing multiple protection strategies in the strategy set includes: if at least two protection strategies in the strategy set are mutually exclusive, then the at least two protection strategies are used as the fused protection strategies in sequence, wherein when each of the at least two protection strategies is triggered, the subset in the data set corresponding to the triggered protection strategy is processed.

[0009] In some embodiments, fusing multiple protection strategies in the strategy set includes: if at least two protection strategies in the strategy set are complementary, then the protection strategy that first meets the triggering condition among the at least two protection strategies is taken as the fused protection strategy.

[0010] In some embodiments, merging multiple protection strategies in the strategy set includes: if at least two protection strategies in the strategy set are not related, then at least two protection strategies are used as the protection strategies corresponding to the data set.

[0011] In some embodiments, fusing multiple protection strategies in the strategy set includes: if there is no relationship between at least two protection strategies in the strategy set, then at least two protection strategies are used as the fused protection strategies in sequence, wherein when each of the at least two protection strategies is triggered, the subset in the data set corresponding to the triggered protection strategy is processed.

[0012] In some embodiments, matching each subset with a corresponding protection policy includes: matching each subset with a corresponding rule tag; and obtaining the protection policy corresponding to each subset based on the correspondence between the rule tag and the protection policy.

[0013] In some embodiments, the rule labels matched for each subset are adjusted using at least one of interaction with a data administrator, natural language processing, and intent analysis.

[0014] In some embodiments, rule labels are determined based on at least one of policy requirements, industry specificity, data characteristics, expert experience, data source, application scenario, security requirements, and production factors.

[0015] In some embodiments, element attribute information includes one or more of the following: data source, usage constraints, application scenario, security requirements, data type, and data fragment attributes.

[0016] According to another aspect of this disclosure, a data processing system is also proposed, comprising: an analyzer configured to classify multiple elements in a data set into multiple subsets according to element attribute information, each subset including elements of the same category; a protector configured to match each subset with a corresponding protection strategy to obtain a strategy set; and a fusion unit configured to fuse multiple protection strategies in the strategy set according to the association between the protection strategies to obtain a fused protection strategy, and to use the fused protection strategy to perform protection processing on the data set.

[0017] In some embodiments, the analyzer, protector, and fusion unit are integrated into the data gateway.

[0018] According to another aspect of this disclosure, a data processing system is also proposed, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the above-described data processing method based on instructions stored in the memory.

[0019] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is also proposed, on which computer program instructions are stored, which, when executed by a processor, implement the data processing method described above.

[0020] In this embodiment of the disclosure, the data is finely classified based on the complexity of industrial data. Instead of processing the data as a whole, corresponding protection strategies are assigned to different categories of data. Based on the relationship between the strategies, the protection strategies are integrated and coordinated, making the data processing process more closely aligned with actual needs and usage habits, meeting the personalized needs of industrial data, and thus improving the data protection processing capability.

[0021] Other features and advantages of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0022] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0023] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0024] Figure 1 This is a flowchart illustrating some embodiments of the data processing method disclosed herein;

[0025] Figure 2 These are schematic diagrams illustrating some embodiments of the data processing procedures disclosed herein;

[0026] Figure 3 These are schematic diagrams illustrating other embodiments of the data processing procedures disclosed herein;

[0027] Figure 4 This is a schematic diagram of the structure of some embodiments of the data processing system disclosed herein; and

[0028] Figure 5 The diagram shows the structure of some other embodiments of the data processing system disclosed herein. Detailed Implementation

[0029] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0030] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0031] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit this disclosure or its application or use.

[0032] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0033] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0034] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0035] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0036] In actual data processing, data components are highly complex. For example, an industrial module data file may contain different data fragments, each with different security requirements. Or, an industrial drawing data package may contain different types of data files (text, video), each with different security requirements. Current technologies cannot meet the personalized needs of each part of industrial data.

[0037] Figure 1 The diagram below illustrates some embodiments of the data processing method disclosed herein. These embodiments are executed by a data processing system, which includes, for example, an analyzer, a protector, and an orchestrator. The analyzer, protector, and orchestrator can be integrated into a data gateway and deployed on the enterprise side to protect enterprise privacy.

[0038] In step 110, according to the element attribute information, the multiple elements in the data set are classified into multiple subsets, and each subset includes elements of the same category.

[0039] In some embodiments, element attribute information includes one or more of the following: data source, usage constraints, application scenario, security requirements, data type, and data fragment attributes.

[0040] To address the issue of insufficient data preprocessing capabilities in the industrial sector, a built-in analyzer preprocesses industrial data. The basic principle for data classification is to group data with the same file type, similar data fragment attributes, and the same security protection requirements together. For example... Figure 2 As shown, the overall data is divided into three categories: data 1, data 2, and data 3.

[0041] In some embodiments, a comprehensive analysis and judgment are performed based on the enterprise user's needs description, data usage scenarios, data sources, and data sub-file types (text, drawings, etc.) to classify and unify the data fragments and files.

[0042] In step 120, each subset is matched with the corresponding protection policy to obtain a policy set.

[0043] In some embodiments, each subset is matched with a corresponding rule label, and a protection policy for each subset is obtained based on the correspondence between the rule labels and protection policies. In this step, a corresponding protection policy is automatically assigned based on the matched classification rules. Enterprises can achieve relatively professional data protection without needing in-depth knowledge of security technologies.

[0044] For example, in the financial industry, data sharing will be used for statistical reporting scenarios. Data is marked with the "usable but not visible" rule label through the rule base. This system will prioritize matching it with "privacy differential technology". By adding noise to the shared data, the system can interfere with the original data while maintaining the accuracy of the statistical results, thus avoiding the over-mining of the original data.

[0045] In some embodiments, rule labels are determined based on at least one of policy requirements, industry specificity, data characteristics, expert experience, data source, application scenario, security requirements, and production factors.

[0046] In some embodiments, the protection strategy includes homomorphic encryption, trusted environment, secure multi-party, differential privacy, federated learning, and data sandbox technologies.

[0047] In some embodiments, the protection policy corresponding to each subset can be a one-to-one relationship, a many-to-one relationship, or a one-to-many relationship.

[0048] In some embodiments, routing strategies, i.e., hierarchical classification rules, are pre-built, and appropriate protection methods are assigned to data according to these rules, with different protection technologies for different categories applied in real time. When building these rules, security requirements, policy requirements, expert experience (plus AI assistance), and multi-dimensional factors from actual production are combined to provide an optimal classification rule base for the data and scenario. For example, as shown in Table 1.

[0049] Table 1

[0050]

[0051] In some embodiments, at least one of the following methods—interaction with data administrators, natural language processing, and intent analysis—is used to adjust the rule labels for each subset. That is, a data- and scenario-driven approach is adopted to adjust the rule labels for each subset, interpreting data characteristics, usage scenarios, etc., to match the optimal classification and grading rules.

[0052] For example, intent analysis can be performed on the information entered by data administrators on the configuration page via semantic input to obtain the data administrators' matching intent. Then, the rule labels assigned to each subset can be adjusted, such as... Figure 3 As shown, the display interface allows for consultation with the data administrator until their needs are met. During rule matching, an intelligent auxiliary model can be selected, such as an AI model that automatically classifies the rule labels corresponding to each subset. This AI model is trained using pre-collected samples.

[0053] In some embodiments, after matching the corresponding rule label to each subset, it is also necessary to assign an appropriate protection method, i.e., a protection strategy, to each subset based on the rule label, providing different types of protection in real time. The relationship between each subset and the rule label can be one-to-one, many-to-one, or one-to-many. Similarly, the relationship between each rule label and the protection strategy can be one-to-one, many-to-one, or one-to-many.

[0054] In some embodiments, the protection strategy corresponding to the rule tags matching each subset can be adjusted by interacting with the data administrator until the requirements are met.

[0055] In step 130, based on the relationship between the protection strategies, the multiple protection strategies in the strategy set are merged to obtain the merged protection strategy, and the merged protection strategy is used to protect the data set.

[0056] like Figure 2 As shown, for example, data 1, data 2 and data 3 are supplemented by 120 to obtain strategy 1, strategy 2 and strategy 3, but through strategy fusion, only strategy 1 and strategy 2 are retained as the protection strategy corresponding to the overall data.

[0057] In some embodiments, the relationship between protection strategies includes one of the following: mutual exclusion, complementarity, and independence. Conflicting protection strategies need to be properly integrated and coordinated. For example, privacy-preserving computation can be directly integrated with homomorphic encryption and secure multi-party communication without technical anomalies; however, federated learning and data transmission cannot coexist due to underlying contradictions.

[0058] If at least two protection policies in the policy set are mutually exclusive, the protection policy with the higher priority among the two will be used as the merged protection policy. For example, if the protection policy corresponding to data segment A is passwordless access and the protection policy corresponding to data segment B is encrypted access, security issues are more sensitive for enterprises. Therefore, the encrypted access protection policy has a higher priority, and thus, the entire data segment adopts the encrypted access protection policy.

[0059] If at least two protection strategies in the strategy set are mutually exclusive, then these at least two protection strategies are sequentially used as the merged protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed. For example, if data segment A corresponds to passwordless access and data segment B corresponds to encrypted access, and the enterprise allows appropriate access, then through time-axis and data flow transformation, for a period of time, the passwordless access protection strategy is used, during which time data segment A is processed; for a period of time, the encrypted access protection strategy is used, during which time data segment B is processed. This is a misaligned combination of protection strategies.

[0060] If at least two protection strategies in the strategy set are complementary, the protection strategy that first meets the trigger condition among the at least two protection strategies will be used as the merged protection strategy. For example, if the protection strategy for data segment A is to use it a maximum of 100 times, and the protection strategy for data segment B is to use it a maximum of 10 days, then both protection strategies for data segment A and data segment B will be used initially. However, if the maximum usage of 100 times is met first, then the maximum usage of 100 times will be considered the protection strategy for the entire data. If the usage of 10 days is met first, then the maximum usage of 10 days will be considered the protection strategy for the entire data.

[0061] If at least two protection policies in the policy set are unrelated, then both of these protection policies will be used as the protection policies corresponding to the data set. For example, if the protection policy for data segment A is to use HTTPS for transmission, and the protection policy for data segment B is to use it 10 times, then these two protection policies will be combined as the protection policy corresponding to the data set.

[0062] If at least two protection strategies in the strategy set are unrelated, then at least two protection strategies are sequentially used as the merged protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed. For example, if the protection strategy for data segment A is HTTPS transmission, and the protection strategy for data segment B is to use it 10 times, then through time axis and data stream conversion methods, for a period of time, the protection strategy of using HTTPS transmission is applied, and during this period, data segment A is processed; for another period of time, the protection strategy of using it 10 times is applied, and during this period, data segment B is processed. This is a misaligned combination of protection strategies.

[0063] In the above embodiments, by taking advantage of the complexity of industrial data, the data is finely classified. From a non-holistic data processing approach, corresponding protection strategies are assigned to different categories of data. Based on the relationship between the strategies, the protection strategies are integrated and coordinated, making the data processing process closer to actual needs and usage habits, meeting the personalized needs of industrial data, and thus improving the data protection processing capability.

[0064] Figure 4 The diagram below shows the structure of some embodiments of the data processing system disclosed herein. The system includes an analyzer 410, a protector 420, and a fusion unit 430, wherein the analyzer 410, the protector 420, and the fusion unit 430 are integrated in a data gateway.

[0065] The analyzer 410 is configured to classify multiple elements in a dataset into multiple subsets based on element attribute information, with each subset containing elements of the same category.

[0066] In some embodiments, element attribute information includes one or more of the following: data source, usage constraints, application scenario, security requirements, data type, and data fragment attributes. Addressing the issue of insufficient data preprocessing capabilities in the industrial sector, a built-in analyzer preprocesses industrial data. The basic principle for classifying data is to group data of the same file type, the same data fragment attributes, and the same security protection requirements together.

[0067] Protector 420 is configured to match each subset with the corresponding protection policy to obtain a policy set.

[0068] In some embodiments, each subset is matched with a corresponding rule tag, and the protection strategy corresponding to each subset is obtained based on the correspondence between the rule tag and the protection strategy.

[0069] In some embodiments, the rule labels matched for each subset are adjusted using at least one of interaction with a data administrator, natural language processing, and intent analysis.

[0070] In some embodiments, rule labels are determined based on at least one of policy requirements, industry specificity, data characteristics, expert experience, data source, application scenario, security requirements, and production factors.

[0071] The merging unit 430 is configured to merge multiple protection strategies in the strategy set according to the relationship between the protection strategies, to obtain a merged protection strategy, and to use the merged protection strategy to protect the data set.

[0072] In some embodiments, the relationship between protection strategies includes one of the following: mutual exclusion, complementarity, and independence. Conflicting protection strategies need to be properly integrated and coordinated. This aggregation effect transforms currently fragmented protection methods (privacy computation, anonymized encryption, etc.) into a systematic guarantee, better serving industrial data.

[0073] If at least two protection policies in the policy set are mutually exclusive, the protection policy with the higher priority among the two will be used as the merged protection policy. For example, if the protection policy corresponding to data segment A is passwordless access and the protection policy corresponding to data segment B is encrypted access, security issues are more sensitive for enterprises. Therefore, the encrypted access protection policy has a higher priority, and thus, the entire data segment adopts the encrypted access protection policy.

[0074] If at least two protection strategies in the strategy set are mutually exclusive, then these at least two protection strategies are sequentially used as the merged protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed. For example, if data segment A corresponds to passwordless access and data segment B corresponds to encrypted access, and the enterprise allows appropriate access, then through time-axis and data flow transformation, for a period of time, the passwordless access protection strategy is used, during which time data segment A is processed; for a period of time, the encrypted access protection strategy is used, during which time data segment B is processed. This is a misaligned combination of protection strategies.

[0075] If at least two protection strategies in the strategy set are complementary, the protection strategy that first meets the trigger condition among the at least two protection strategies will be used as the merged protection strategy. For example, if the protection strategy for data segment A is to use it a maximum of 100 times, and the protection strategy for data segment B is to use it a maximum of 10 days, then both protection strategies for data segment A and data segment B will be used initially. However, if the maximum usage of 100 times is met first, then the maximum usage of 100 times will be considered the protection strategy for the entire data. If the usage of 10 days is met first, then the maximum usage of 10 days will be considered the protection strategy for the entire data.

[0076] If at least two protection policies in the policy set are unrelated, then both of these protection policies will be used as the protection policies corresponding to the data set. For example, if the protection policy for data segment A is to use HTTPS for transmission, and the protection policy for data segment B is to use it 10 times, then these two protection policies will be combined as the protection policy corresponding to the data set.

[0077] If at least two protection strategies in the strategy set are unrelated, then at least two protection strategies are sequentially used as the merged protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed. For example, if the protection strategy for data segment A is HTTPS transmission, and the protection strategy for data segment B is to use it 10 times, then through time axis and data stream conversion methods, for a period of time, the protection strategy of using HTTPS transmission is applied, and during this period, data segment A is processed; for another period of time, the protection strategy of using it 10 times is applied, and during this period, data segment B is processed. This is a misaligned combination of protection strategies.

[0078] In the above embodiments, leveraging the complexity of industrial data, corresponding protection strategies are assigned to different categories of data using a non-holistic data processing approach. Furthermore, based on the relationships between these strategies, they are integrated and coordinated, making the data processing process more closely aligned with actual needs and usage habits, meeting the personalized requirements of industrial data, and thus improving data protection capabilities. Additionally, by encapsulating the analyzer, protector, and fusion unit in a gateway format, it can be flexibly deployed as an enterprise's own system without compromising enterprise data privacy.

[0079] Figure 5 The diagram illustrates the structure of some other embodiments of the data processing system disclosed herein. The system 500 includes a memory 510 and a processor 520. The memory 510 can be a disk, flash memory, or any other non-volatile storage medium. The memory is used to store instructions from the above embodiments. The processor 520 is coupled to the memory 510 and can be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 520 is used to execute the instructions stored in the memory.

[0080] In some embodiments, the processor 520 is coupled to the memory 510 via a BUS bus 530. The system 500 can also be connected to an external storage system 550 via a storage interface 540 to access external data, and can also be connected to a network or another computer system (not shown) via a network interface 560. Further details are omitted here.

[0081] In this embodiment, data instructions are stored in a memory and then processed by a processor. By analyzing the structure, dividing and conquering, and fusing and matching, the optimal strategy is finally determined, which can solve the problem in related technologies that only protect overall data and cannot protect the accuracy of data objects with complex structures.

[0082] In other embodiments, a computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the steps of the methods described above. Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, apparatus, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0083] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0084] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0085] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0086] This concludes the detailed description of the present disclosure. To avoid obscuring the concept of the disclosure, some details known in the art have not been described. Those skilled in the art will fully understand how to implement the technical solutions disclosed herein based on the above description.

[0087] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A data processing method, executed by a data processing system, comprising: Based on element attribute information, multiple elements in the dataset are classified into multiple subsets, and each subset includes elements of the same category; Each subset is matched with its corresponding protection strategy to obtain a strategy set; as well as Based on the relationships between the protection strategies, multiple protection strategies in the strategy set are merged to obtain a merged protection strategy. The merged protection strategy is then used to protect the data set. The relationships between the protection strategies include one of the following: mutual exclusion, complementary, and independent strategies.

2. The data processing method according to claim 1, wherein, The fusion of multiple protection strategies in the strategy set includes: If at least two protection strategies in the strategy set are mutually exclusive, then the protection strategy with higher priority among the at least two protection strategies shall be used as the fused protection strategy.

3. The data processing method according to claim 1, wherein, The fusion of multiple protection strategies in the strategy set includes: If at least two protection strategies in the strategy set are mutually exclusive, then the at least two protection strategies are sequentially used as the fused protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed.

4. The data processing method according to claim 1, wherein, The fusion of multiple protection strategies in the strategy set includes: If at least two protection strategies in the strategy set are complementary, then the protection strategy that first meets the triggering condition among the at least two protection strategies shall be used as the fused protection strategy.

5. The data processing method according to claim 1, wherein, The fusion of multiple protection strategies in the strategy set includes: If at least two protection strategies in the strategy set are not related, then both of the at least two protection strategies will be used as the protection strategies corresponding to the data set.

6. The data processing method according to claim 1, wherein, The fusion of multiple protection strategies in the strategy set includes: If there is no correlation between at least two protection strategies in the strategy set, then the at least two protection strategies are sequentially used as the fused protection strategy. When each of the at least two protection strategies is triggered, the subset of the data set corresponding to the triggered protection strategy is processed.

7. The data processing method according to claim 1, wherein, Matching each subset with its corresponding protection strategy includes: Match each subset to the corresponding rule label; and Based on the correspondence between rule labels and protection strategies, the protection strategy corresponding to each subset is obtained.

8. The data processing method according to claim 7 further includes: The rule labels matching each subset are adjusted using at least one of the following methods: interaction with the data administrator, natural language processing, and intent analysis.

9. The data processing method according to claim 7, wherein, The rule labels are determined based on at least one of the following: policy requirements, industry specificity, data characteristics, expert experience, data source, application scenario, security requirements, and production factors.

10. The data processing method according to any one of claims 1 to 9, wherein, The element attribute information includes: One or more of the following: data source, usage constraints, application scenario, security requirements, data type, and data fragment attributes.

11. A data processing system, comprising: The analyzer is configured to classify multiple elements in a dataset into multiple subsets based on element attribute information, with each subset containing elements of the same category; The protector is configured to match each subset with a corresponding protection policy to obtain a policy set; as well as The fusion unit is configured to fuse multiple protection strategies in the policy set according to the association between protection strategies to obtain a fused protection strategy, and to use the fused protection strategy to perform protection processing on the data set. The association between the protection strategies includes one of policy mutual exclusion, policy complementarity, and policy independence.

12. The data processing system according to claim 11, wherein, The analyzer, the protector, and the fusion unit are integrated in the data gateway.

13. A data processing system, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to perform the data processing method of any one of claims 1 to 10 based on instructions stored in the memory.

14. A non-transitory computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the data processing method as described in any one of claims 1 to 10.

Images