Identity information dynamic desensitization method and system based on SM4 and SM9 algorithms

Abstract

The present invention provides a method and system for dynamic desensitization of identity information based on SM4 and SM9 algorithms, including: segmenting the original identity information to obtain sensitive segment information and common segment information; dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; extracting characteristic values ​​of the common segment information through a preset hash function, and converting them into coded data in a preset format to obtain converted common segment information; splicing the converted common segment information and the encrypted sensitive segment information to obtain preliminary desensitized data; encrypting the preliminary desensitized data to generate encrypted ciphertext based on the SM9 algorithm, and embedding the unique identity associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information. In the present invention, not only can dynamic desensitization of identity information be achieved, but also the data format can be kept unchanged.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and system for dynamic desensitization of identity information based on SM4 and SM9 algorithms. Background Art

[0002] Identity information is highly sensitive data. If there is a lack of effective protection measures during storage, transmission or processing, it is very vulnerable to security threats such as data leakage, tampering, and theft. Once such incidents occur, it will not only cause serious infringement of personal privacy and lead to illegal use of personal information, but also cause a devastating blow to the credibility and reputation of enterprises and related institutions.

[0003] Although traditional data desensitization methods can obfuscate or replace data to a certain extent, they often have many limitations. For example, some desensitization methods lack dynamism and cannot flexibly adjust desensitization strategies according to different application scenarios and security requirements; some methods easily destroy the original format and structure of the data during the desensitization process, resulting in compatibility issues or information loss in subsequent data processing and analysis. Summary of the invention

[0004] The main purpose of the present invention is to provide a method and system for dynamic desensitization of identity information based on SM4 and SM9 algorithms, aiming to overcome the defects of the current desensitization algorithm that cannot dynamically adjust the desensitization strategy and destroy the original format of the data.

[0005] To achieve the above object, the present invention provides a method for dynamic desensitization of identity information based on SM4 and SM9 algorithms, comprising the following steps:

[0006] The original identity information is segmented into sensitive segment information and common segment information;

[0007] Dynamically generate a key based on the SM4 algorithm, and encrypt the sensitive segment information to obtain encrypted sensitive segment information; wherein the key is dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed;

[0008] Extracting characteristic values ​​of the common segment information by using a preset hash function, and converting the characteristic values ​​into coded data in a preset format to obtain converted common segment information;

[0009] According to a pre-set splicing order rule determined based on the parity of the number of encryption rounds of the SM4 algorithm, the converted common segment information and the encrypted sensitive segment information are spliced ​​to obtain preliminary desensitized data;

[0010] The preliminary desensitized data is encrypted based on the SM9 algorithm to generate encrypted ciphertext, and the unique identity identifier associated with the original identity information is embedded in the encrypted ciphertext in an encrypted manner to obtain the desensitized identity information.

[0011] Furthermore, the data format of the desensitized identity information is the same as the data format of the original identity information;

[0012] The original identity information includes geographic information, contact information, and ID number.

[0013] Furthermore, the dynamic key generation based on the SM4 algorithm includes:

[0014] Real-time acquisition of timestamp information, current processing data volume information, and network connection status information as real-time operation parameters;

[0015] Performing an XOR operation on a preset basic key seed and the timestamp information to obtain a first intermediate value;

[0016] Performing a bit-joining operation on the first intermediate value and the currently processed data volume information to obtain a second intermediate value;

[0017] The second intermediate value is subjected to a cyclic shift mixing operation with the network connection state information to obtain a final dynamic key.

[0018] Furthermore, extracting the characteristic value of the common segment information by a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted common segment information, including:

[0019] Selecting a hash function combination with anti-collision and high hash distribution, wherein the hash function combination includes two hash algorithms with different construction principles;

[0020] Inputting the common segment information into the hash function combination in sequence to extract feature values;

[0021] An interleaving algorithm based on the error correction coding principle is used to concatenate and fuse the eigenvalues ​​output by each round of hash functions to obtain a fused eigenvalue.

[0022] The fused feature value is converted according to a preset coding mapping table to obtain converted common segment information.

[0023] Furthermore, in the feature value extraction process of each round of hash function in the hash function combination, a random salt value is introduced, and the random salt value is generated by a confusion function based on the current hardware identification information and the real-time timestamp information;

[0024] The preset coding mapping table is constructed based on discrete logarithmic transformation on a finite field, and maps the characteristic value to coded data in a preset format, thereby obtaining converted common segment information.

[0025] Furthermore, the pre-set splicing order rule based on the parity of the number of encryption rounds of the SM4 algorithm includes:

[0026] Determine the parity of the number of encryption rounds performed when the SM4 algorithm encrypts sensitive segment information;

[0027] If the number of encryption rounds is an odd number, the converted common segment information is grouped in a back-to-front order, with three bytes in each group, and the encrypted sensitive segment information is grouped in a front-to-back order, with four bytes in each group; a group of converted common segment information and a group of encrypted sensitive segment information are alternately selected for splicing, and a two-byte connection identifier generated by the encryption algorithm based on the current system process ID and the network session port number is inserted between the two groups of data during splicing;

[0028] If the number of encryption rounds is even, the converted common segment information is grouped in a front-to-back order, with five bytes as a group, and the encrypted sensitive segment information is grouped in a back-to-front order, with three bytes as a group. A group of encrypted sensitive segment information and a group of converted common segment information are alternately selected for splicing. When splicing, a three-byte separator obtained by hashing the current system timestamp and a randomly generated three-bit check code is inserted between the two groups of data.

[0029] Furthermore, after obtaining the desensitized identity information, the following steps are included:

[0030] Storing the desensitized identity information in a database;

[0031] Obtaining algorithm parameters of the SM4 algorithm and parameter characteristics of the SM9 algorithm;

[0032] generating an identification code based on the algorithm parameters and the parameter characteristics;

[0033] The desensitized identity information in the database is identified based on the identification code.

[0034] Furthermore, the algorithm parameters include block length, key length, and number of encryption rounds, and the parameter characteristics include base point coordinate values ​​of elliptic curve parameters and computational efficiency index values ​​of bilinear pairings;

[0035] Based on the algorithm parameters and the parameter characteristics, generating an identification code includes:

[0036] Dynamically determine the weights of the packet length, key length, and number of encryption rounds based on the nonlinear complexity of the SM4 algorithm, the diffusion characteristics of the key expansion algorithm, and the degree of confusion of the round function, and perform weighted summation to obtain a first value;

[0037] Mapping the first numerical value onto a complex plane using a fractal function, extracting a quantized value from geometric features of the mapped fractal pattern, and converting the quantized value into a ternary sequence of a preset length;

[0038] The base point coordinate values ​​in the elliptic curve parameters are encrypted and compressed based on the lattice cipher, the compressed data is XORed with the computational efficiency index value of the bilinear pairing, and the XOR result is subjected to chaotic encryption mapping to obtain an encrypted sequence;

[0039] The ternary sequence is converted into a DNA base sequence according to a preset DNA coding rule, the encrypted sequence is used as the initial key of quantum encryption, the DNA base sequence is encoded and encrypted through the superposition state and entanglement state of quantum bits to obtain an identification code.

[0040] The present invention also provides an identity information dynamic desensitization system based on SM4 and SM9 algorithms, comprising:

[0041] The segmentation module is used to segment the original identity information into sensitive segment information and common segment information;

[0042] An encryption module, used for dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein the keys are dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed;

[0043] A conversion module, used to extract the characteristic value of the common segment information through a preset hash function, and convert the characteristic value into coded data in a preset format to obtain converted common segment information;

[0044] A splicing module, used for splicing the converted common segment information and the encrypted sensitive segment information according to a pre-set splicing sequence rule determined based on the parity of the number of encryption rounds of the SM4 algorithm to obtain preliminary desensitized data;

[0045] The desensitizing module is used to encrypt the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, and embed the unique identity identifier associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information.

[0046] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0047] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0048] The method and system for dynamic desensitization of identity information based on SM4 and SM9 algorithms provided by the present invention include: segmenting the original identity information to obtain sensitive segment information and common segment information; dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein, dynamically generating keys by collecting real-time operating parameters and combining with a preset basic key seed; extracting the characteristic value of the common segment information through a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted common segment information; splicing the converted common segment information and the encrypted sensitive segment information according to a pre-set splicing sequence rule determined by the parity of the number of encryption rounds based on the SM4 algorithm to obtain preliminary desensitized data; encrypting the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, and embedding the unique identity associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information. In the present invention, by combining the SM4 and SM9 algorithms, not only can dynamic desensitization of identity information be achieved, but also the data format can be kept unchanged. It overcomes the defects of the current desensitization algorithm that it cannot dynamically adjust the desensitization strategy and destroys the original format of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a schematic diagram of the steps of a method for dynamic desensitization of identity information based on SM4 and SM9 algorithms in one embodiment of the present invention;

[0050] Figure 2 This is a structural block diagram of an identity information dynamic desensitization system based on SM4 and SM9 algorithms in one embodiment of the present invention;

[0051] Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0052] The implementation, functional features and advantages of the present invention will be further described in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0054] Reference Figure 1In one embodiment of the present invention, a method for dynamic desensitization of identity information based on SM4 and SM9 algorithms is provided, comprising the following steps:

[0055] Step S1, segmenting the original identity information into sensitive segment information and common segment information;

[0056] Step S2, dynamically generating a key based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein the key is dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed;

[0057] Step S3, extracting the characteristic value of the common segment information by a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted common segment information;

[0058] Step S4, splicing the converted common segment information and the encrypted sensitive segment information according to a pre-set splicing order rule determined based on the parity of the number of encryption rounds of the SM4 algorithm to obtain preliminary desensitized data;

[0059] Step S5, encrypting the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, embedding the unique identity identifier associated with the original identity information into the encrypted ciphertext in an encrypted manner, and obtaining the desensitized identity information.

[0060] In this embodiment, as described in step S1 above, the original identity information needs to be analyzed in depth first to determine which parts of it belong to sensitive information segments and which parts belong to ordinary information segments. For example, for an ID card number, usually the name, ID card number itself, etc. belong to the sensitive information segment, while some common information in the address (such as province, city, etc.) may be regarded as ordinary segment information; for a mobile phone number, the main body of the number is a sensitive segment, and some broad information in the place of origin is an ordinary segment. Through accurate data segmentation, it can provide a basis for subsequent differentiated processing, so that the desensitization process can not only effectively protect key privacy, but also retain the availability and business relevance of the data to a certain extent.

[0061] As described in step S2 above: by collecting the real-time operating parameters of the system, such as system time, current network traffic characteristics, operating status values ​​of specific hardware, etc., these parameters that change in real time and have a certain degree of randomness are combined with the preset basic key seed. The above combination is not a simple splicing, but a series of complex mathematical transformations and logical operations. For example, the basic key seed is first expanded and transformed, and then mixed with the real-time operating parameters that have been preprocessed (such as normalization, encoding conversion, etc.), such as XOR, shift, nonlinear function mapping, etc., to finally generate a dynamic, one-time key. The dynamic key is used to perform SM4 encryption operations on sensitive segment information. The encryption process of the SM4 algorithm will group the sensitive segment information according to its group length (128 bits), and then perform multiple rounds of encryption transformation on each group of data. Each round includes linear and nonlinear substitution, shift and other operations, thereby converting sensitive information into encrypted sensitive segment information, greatly improving the security of sensitive information, and due to the dynamic nature of the key, even if the attacker obtains part of the encrypted information, it is difficult to crack other encrypted data with a fixed key.

[0062] As described in step S3 above, a hash function (such as SHA-256 or other hash functions with good anti-collision and hash distribution) is selected, and the ordinary segment information is input into the hash function. The hash function compresses and maps the input data according to its internal mathematical algorithm, and outputs a hash value of a fixed length, which is the characteristic value of the ordinary segment information. Then, the above characteristic value is converted according to a preset encoding format, for example, it is converted into a hexadecimal code of a specific length or encoded data based on a certain custom encoding table. This conversion further obscures the content of the original ordinary segment information on the one hand, and on the other hand, makes the converted ordinary segment information more compatible with subsequent processing steps, while retaining certain data features for data identification and classification, while enhancing the security and confidentiality of the ordinary segment information.

[0063] As described in step S4 above, the pre-set splicing order rule is based on the parity of the number of encryption rounds of the SM4 algorithm, which is an innovative design idea. When the number of SM4 encryption rounds is an odd number, a specific splicing mode is adopted; when the number of encryption rounds is an even number, another different splicing mode is adopted. Through this splicing rule associated with the number of encryption rounds, not only the generation of desensitized data has a certain degree of dynamics and randomness, which increases the difficulty for attackers to crack, but also the data can be further integrated and optimized during the splicing process, ensuring that the initial desensitized data contains both processed sensitive information and ordinary information, and can maintain the consistency and availability of the data in subsequent processing and application.

[0064] As described in step S5 above, the preliminary desensitized data is encrypted using the SM9 algorithm, which is based on the mathematical principle of bilinear pairing and realizes encryption operations through the cooperation of the master public key and the user's private key. During the encryption process, the preliminary desensitized data will be subjected to complex mathematical transformations to convert it into encrypted ciphertext, which has high security and anti-cracking properties. At the same time, the unique identity associated with the original identity information (such as the specific number part in the ID card number, the unique identification code of the mobile phone number, etc.) is embedded in the encrypted ciphertext in an encrypted manner. This embedding method is not a simple addition, but is encrypted and arranged in position, such as after the identity is hashed, it is merged with the specific part of the encrypted ciphertext, or the identity is encrypted using the key of the SM9 algorithm and then inserted into the specified position in the ciphertext. In this way, while ensuring the security of the desensitized identity information, the data format of the desensitized identity information is the same as the data format of the original identity information, and it can be traced back to the source of the original identity information or perform identity authentication and other operations through corresponding decryption and parsing operations when necessary, ensuring the manageability and traceability of the data throughout the life cycle.

[0065] In one embodiment, the data format of the desensitized identity information is the same as the data format of the original identity information;

[0066] The original identity information includes geographic information, contact information, and ID number.

[0067] In one embodiment, the dynamic key generation based on the SM4 algorithm includes:

[0068] Real-time acquisition of timestamp information, current processing data volume information, and network connection status information as real-time operation parameters;

[0069] Performing an XOR operation on a preset basic key seed and the timestamp information to obtain a first intermediate value;

[0070] Performing a bit-joining operation on the first intermediate value and the currently processed data volume information to obtain a second intermediate value;

[0071] The second intermediate value is subjected to a cyclic shift mixing operation with the network connection state information to obtain a final dynamic key.

[0072] In this embodiment, the timestamp can accurately record the time point of the current system, and has natural dynamics and uniqueness. In cryptographic applications, since it changes all the time, the keys generated based on it have the characteristics of changing over time. The keys generated at different times are different, which greatly increases the difficulty for attackers to crack encrypted information through fixed keys.

[0073] The current amount of data being processed reflects the size of the data that the system is currently processing. Different amounts of data can introduce additional randomness and diversity to key generation. Because different data processing scales mean that the system is in different workload states, combining this state information to generate keys makes the keys closely related to the actual operation of the system. For example, when processing a large amount of identity information for batch desensitization and a small amount of scattered identity information for desensitization, the generated keys will be different due to different amounts of data, which further ensures the security and dynamic adaptability of encryption.

[0074] Network connection status information covers many aspects such as network bandwidth, network latency, and connection stability. The network environment itself is complex and changeable, and these status information are also random. For example, the key generated when the network bandwidth is high, the latency is low, and the connection is stable is different from the key generated when the network fluctuates and the bandwidth is limited. Using network connection status information to participate in key generation can make the key better adapt to the encryption requirements in different network scenarios and prevent attackers from finding patterns and cracking encrypted content due to network-related factors.

[0075] XOR is a basic logic operation, which is characterized by the fact that when two input bits are the same, the output is 0, and when they are not the same, the output is 1. Here, the preset basic key seed is XORed with the timestamp information, which is based on its unique mathematical properties to dynamically change the basic key seed. The basic key seed is usually a relatively fixed key data set during the initial configuration of the system. By XORing it with the ever-changing timestamp information, the changing factors of the time dimension can be superimposed on the original key seed, so that the first intermediate value obtained not only retains some characteristics of the basic key seed, but also incorporates the dynamics brought by the timestamp.

[0076] The above bit splicing operation is to connect the two data together in the order of binary bits. By bit splicing the first intermediate value with the current processing data volume information, it is to further integrate the system data processing state into the key generation process. The first intermediate value already carries the relevant characteristics of the basic key and timestamp, and the current processing data volume information represents the system load with its unique value. The second intermediate value formed after splicing integrates more dimensional information.

[0077] The circular shift mixing operation is an operation that performs a specific transformation on binary data. It can circularly shift the positions of each bit in the data according to certain rules, and combine it with other mathematical operations (such as AND, OR, XOR, etc.) to achieve deep mixing and transformation of data. The operation is used here to deeply integrate the second intermediate value that has already integrated the basic key seed, timestamp information, and the current processing data volume information with the network connection status information. The network connection status information itself is complex and random. Through the circular shift mixing operation, these characteristics can be fully integrated into the final dynamic key. For example, after the second intermediate value is circularly shifted, the position of some key bits changes, and then it is mixed with the binary sequence corresponding to the network connection status information through XOR and other operations. The dynamic key finally generated becomes extremely complex in structure and value and has a highly dynamic change characteristic. At each encryption, a unique key can be generated based on the real-time multi-faceted status of the system, which effectively guarantees the security of identity information encrypted based on the SM4 algorithm.

[0078] In this embodiment, a multi-step operation is performed using a variety of real-time operating parameters and a preset basic key seed, and the generated dynamic key can fully adapt to the real-time status of the system, providing a high-intensity, dynamically changing and highly secure key foundation for the subsequent use of the SM4 algorithm to encrypt sensitive segment information, effectively improving the security and reliability of the entire identity information dynamic desensitization method.

[0079] In one embodiment, extracting the characteristic value of the common segment information by a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted common segment information includes:

[0080] Selecting a hash function combination with anti-collision and high hash distribution, wherein the hash function combination includes two hash algorithms with different construction principles;

[0081] Inputting the common segment information into the hash function combination in sequence to extract feature values;

[0082] An interleaving algorithm based on the error correction coding principle is used to concatenate and fuse the eigenvalues ​​output by each round of hash functions to obtain a fused eigenvalue.

[0083] The fused feature value is converted according to a preset coding mapping table to obtain converted common segment information.

[0084] In this embodiment, in the field of cryptography and data processing, the anti-collision and high hash distribution of the hash function are extremely critical characteristics. Anti-collision means that for different input data, it is difficult for two different inputs to obtain the same output result after the hash function operation, which can ensure that the extracted eigenvalues ​​can accurately and uniquely correspond to the corresponding common segment information, avoiding confusion and misjudgment of data features. High hash distribution ensures that after the input data is processed by the hash function, the output hash value is evenly distributed in the entire hash space, and there will be no phenomenon of aggregation near certain specific values. This can make the generated eigenvalues ​​more random and representative, laying the foundation for subsequent processing and data security.

[0085] The combination of hash algorithms with two different construction principles is selected to further enhance the security and effectiveness of hash processing. Hash algorithms with different construction principles differ in internal operation logic and data processing methods. For example, one construction method is based on iterative compression, and the other is a mapping method based on mathematical problems (such as discrete logarithm problems). When faced with ordinary segment information of various structures and contents, this combination can extract features from multiple angles to make up for the loopholes or deficiencies that may exist in a single hash algorithm. It is like using two different types of "locks" to process data. If an attacker wants to crack and forge the same feature value, he needs to break through the protection of two different mechanisms at the same time, which greatly increases the difficulty of cracking and improves the reliability and security of data processing.

[0086] Input the common segment information into the selected hash function combination in turn. Each common segment information will be operated by two hash algorithms with different construction principles to obtain the corresponding hash values. This process is equivalent to multi-dimensional feature capture of common segment information. Different hash algorithms will extract and map various intrinsic features such as byte sequence, data structure, character regularity, etc. in the common segment information according to their own operation rules, and finally output the corresponding feature value (i.e. hash value). For example, for a common segment text containing address information, one hash algorithm focuses on mapping statistical features such as character occurrence frequency to obtain a hash value, while another hash algorithm focuses on structural features such as the order of character arrangement in the text to generate another different hash value. In this way, the features of the common segment information are fully extracted, providing rich and diverse materials for subsequent fusion processing.

[0087] The principle of error correction coding was originally commonly used in fields such as communications, aiming to be able to recover correct data information even when there is noise interference or partial data errors. Here, an interleaving algorithm based on this principle is applied to splice and fuse the eigenvalues ​​output by each round of hash functions, taking advantage of its ability to enhance data stability and anti-interference. The interleaving algorithm scrambles and recombines the eigenvalues ​​output by different hash functions through specific rules, interweaving them together to form a more compact structure with inherent error correction capabilities.

[0088] For example, suppose the eigenvalues ​​obtained by two hash algorithms are eigenvalue A and eigenvalue B. Through the interleaving algorithm, they are not simply connected end to end, but are fused in an alternating manner such as part of A, part of B, another part of A, another part of B..., so that the final fused eigenvalue is no longer a simple combination of two independent eigenvalues, but a new data that has been deeply integrated, has stronger internal correlation and has certain error correction capabilities. In this way, in the subsequent processing process, even if the data is interfered with to a certain extent or some information is biased, it can still restore accurate feature information as much as possible with its inherent error correction structure and correlation, ensuring the integrity and stability of the data features.

[0089] The above-mentioned preset encoding mapping table is a data conversion reference constructed according to specific rules and business requirements. It defines the correspondence from the fused feature value to the target format coded data, which can be set based on multiple factors such as security, compatibility, or convenience of subsequent processing. Through such a mapping table, the fused feature value, which is relatively abstract and may not meet the requirements of subsequent applications, can be converted into a coded data in a preset format that is more in line with established standards and easy for the system to identify and process.

[0090] In one embodiment, during the feature value extraction process of each round of hash function in the hash function combination, a random salt value is introduced, and the random salt value is generated by a confusion function based on the current hardware identification information and real-time timestamp information;

[0091] The preset coding mapping table is constructed based on discrete logarithmic transformation on a finite field, and maps the characteristic value to coded data in a preset format, thereby obtaining converted common segment information.

[0092] In this embodiment, introducing a random salt value when the hash function extracts the feature value is an important means to enhance data security and feature uniqueness. Although the hash function itself has the function of mapping different inputs to specific outputs, if there is no additional random factor involved, the hash value of its output is fixed for the same input. This poses certain security risks. For example, an attacker can use a pre-built rainbow table (a table of pre-calculated correspondences between common inputs and hash values) to try to crack the original data corresponding to the hash value. After the random salt value is introduced, even for the same common segment information input, the final hash value (i.e., the feature value) will be different due to the different random salt values ​​added each time, which greatly increases the difficulty for attackers to crack and improves the confidentiality of the data.

[0093] The above random salt value is generated based on the current hardware identification information and real-time timestamp information through the obfuscation function, which has unique considerations.

[0094] Hardware identification information (such as the MAC address of a network card, the unique serial number of a computer, etc.) is usually fixed and unique for each device, and it represents an inherent property of the device itself. Using it as a basic element to generate a random salt value gives the salt value a device-specific feature. When different devices process the same common segment information, the generated salt values ​​will be different due to different hardware identifications, and thus different hash feature values ​​will be generated, which can distinguish the source of data to a certain extent, while increasing the diversity and randomness of data processing in the entire system.

[0095] Timestamp information is constantly changing and is naturally dynamic. The timestamp of each moment is unique. After combining the hardware identification information and processing it through the obfuscation function, the generated random salt value can be dynamically updated over time, further ensuring the unpredictability of the salt value during each hash operation. For example, on the same device, when processing the same common segment information at different times, the generated random salt value is different because the timestamp is different, and the final hash feature value is also different, which effectively prevents the possibility of attackers obtaining the original data by analyzing fixed patterns.

[0096] The obfuscation function plays a key role here. It receives hardware identification information and real-time timestamp information as input, and through complex mathematical transformations and logical operations, deeply integrates and scrambles these two originally relatively independent and different information, and outputs a random salt value that meets the requirements. The above function involves multiple operations such as XOR operations, shift operations, and nonlinear transformations, which fully "obfuscate" the input information, making the final generated salt value highly random and unpredictable, making it difficult for attackers to reverse the salt value to infer its generation source and the original hardware and time-related information.

[0097] The discrete logarithm problem over a finite field is an important mathematical foundation for many encryption algorithms in modern cryptography. It has the characteristics of high computational complexity, that is, it is difficult to quickly calculate the corresponding discrete logarithm given a finite field, generator, and power. Constructing a coding mapping table based on such mathematical characteristics can give the coding process a strong security guarantee. Because this mapping relationship is not a simple and intuitive correspondence, but is built on the basis of a complex discrete logarithm transformation, the conversion process from the eigenvalue to the preset format coded data has cryptographic confidentiality and anti-cracking properties.

[0098] After the fused eigenvalue is obtained, the conversion operation is performed according to the coding mapping table constructed based on the discrete logarithmic transformation on the finite field. Specifically, each part of the eigenvalue (such as a specific number of bits in the binary sequence) will correspond to the corresponding part of the preset format coded data according to the discrete logarithmic transformation related rules defined in the mapping table. For example, a certain segment of the binary representation of the eigenvalue is mapped to a specific character in the hexadecimal code or a coded segment of a specific length according to the calculation result of the discrete logarithmic transformation. By performing such mapping conversion on the entire fused eigenvalue segment by segment, it is finally converted into coded data of the preset format that meets the requirements, that is, the converted ordinary segment information is obtained. The above conversion method not only ensures that the ordinary segment information exists in a standardized format after processing, which is convenient for subsequent processing (such as splicing with other desensitized data, etc.), but more importantly, it utilizes the cryptographic characteristics of the discrete logarithmic transformation, so that the entire conversion process has a high degree of security. Even if the attacker obtains the converted coded data, it is difficult to reversely deduce the original fused eigenvalue and the original ordinary segment information, which builds a solid security line for the processing of ordinary segment information in dynamic desensitization of identity information.

[0099] In one embodiment, the pre-set splicing order rule based on the parity of the number of encryption rounds of the SM4 algorithm includes:

[0100] Determine the parity of the number of encryption rounds performed when the SM4 algorithm encrypts sensitive segment information;

[0101] If the number of encryption rounds is an odd number, the converted common segment information will be grouped in a back-to-front order, with three bytes in each group; unlike the conventional front-to-back grouping method, it changes the original order structure of the data, making it difficult for attackers to infer the original common segment information content according to conventional reading and parsing habits. Moreover, the setting of three bytes in a group takes into account factors such as the amount of data in the common segment information and the convenience of subsequent splicing and matching, which can not only ensure the reasonable segmentation of the common segment information to a certain extent, but also facilitate orderly alternating splicing operations with the encrypted sensitive segment information.

[0102] The encrypted sensitive segment information is grouped in a sequence from front to back, with four bytes in each group. A group of converted ordinary segment information and a group of encrypted sensitive segment information are alternately selected for splicing. When splicing, a two-byte connection identifier generated by the encryption algorithm based on the current system process ID and the network session port number is inserted between the two groups of data. This alternating method allows two different types of data (ordinary segments and sensitive segments after different processing) to be evenly mixed together, further disrupting the original layout of the data, making the overall data structure complex and difficult to disassemble and analyze. The two-byte connection identifier generated by the encryption algorithm based on the current system process ID and the network session port number is inserted between the two groups of data to add additional relevance and verification information to the spliced ​​data. The system process ID can identify the specific process where the current data processing is located. The network session port number reflects the relevant information at the network communication level. They are generated into a connection identifier through an encryption algorithm. On the one hand, the real-time and unique parameters during system operation are utilized to make the connection identifier dynamic and unique. On the other hand, encryption processing is used to ensure its confidentiality to prevent attackers from tampering with or forging the identifier. At the same time, it is also convenient for subsequent analysis, verification and other operations on the preliminary desensitized data to confirm the integrity and legitimacy of the data by identifying and verifying the connection identifier.

[0103] If the number of encryption rounds is even, the converted common segment information is grouped in a front-to-back order, with five bytes as a group, and the encrypted sensitive segment information is grouped in a back-to-front order, with three bytes as a group. A group of encrypted sensitive segment information and a group of converted common segment information are alternately selected for splicing. When splicing, a three-byte separator obtained by hashing the current system timestamp and a randomly generated three-bit check code is inserted between the two groups of data.

[0104] The selection of every five bytes in a group also takes into account factors such as the overall data volume and the adaptability of subsequent splicing. By changing the group length and order, the ordinary segment information presents different structural characteristics in the case of even-numbered rounds of encryption than in odd-numbered rounds, which increases the complexity and diversity of the data and makes it difficult for attackers to find a unified rule to crack or restore the original data. The encrypted sensitive segment information is grouped in a back-to-front order, with three bytes in each group. This reverse grouping order is opposite to the grouping order of the sensitive segment information in odd-numbered rounds, which changes the starting and arrangement of the sensitive segment information in the splicing, making the splicing results in even-numbered rounds significantly different from those in odd-numbered rounds, further improving the randomness and unpredictability of the data. The division of every three bytes in a group is also considered from the perspective of facilitating alternating splicing with ordinary segment information and reflecting the internal structure of the encrypted sensitive segment information, which helps to construct a reasonable and complex preliminary desensitized data.

[0105] Inserting a three-byte separator obtained by hashing the current system timestamp and a randomly generated three-digit checksum plays an important role. The system timestamp has the characteristics of real-time dynamic change and uniqueness. The randomly generated three-digit checksum increases the randomness of the separator. After the hash operation, not only does the separator have strong anti-collision and confidentiality, but it can also use the irreversibility of the hash operation to prevent attackers from reversely deriving relevant original information through the separator. This separator plays multiple roles in distinguishing different groups of data, assisting in verifying data integrity, and increasing the difficulty of data cracking in the spliced ​​data, which helps to improve the overall quality and security of the initial desensitized data.

[0106] In one embodiment, after obtaining the desensitized identity information, the following steps are included:

[0107] Storing the desensitized identity information in a database;

[0108] Obtaining algorithm parameters of the SM4 algorithm and parameter characteristics of the SM9 algorithm;

[0109] generating an identification code based on the algorithm parameters and the parameter characteristics;

[0110] The desensitized identity information in the database is identified based on the identification code.

[0111] In this embodiment, after completing the dynamic desensitization processing of the identity information, the obtained desensitized identity information needs to be properly preserved. The desensitized identity information is stored in the database. First, it is convenient for subsequent data retrieval, analysis and use in legal and compliant business scenarios. For example, enterprises conduct big data analysis based on desensitized user identity information to optimize service strategies without involving the risk of privacy leakage; second, it is convenient for unified management. Through the database permission setting, backup and recovery and other mechanisms, the security, integrity and availability of desensitized identity information can be guaranteed during long-term storage, making it part of the enterprise or organization's data assets for orderly management.

[0112] The parameters of the SM4 algorithm include key information such as packet length, key length, number of encryption rounds, and encryption mode used. These parameters determine the specific behavior and encryption effect of the SM4 algorithm in the process of encrypting sensitive information. By obtaining these parameters, we can accurately understand the application of the SM4 algorithm in this desensitization process. For example, by understanding the number of encryption rounds, we can know how many times the data has undergone encryption transformations, and the packet length reflects the basic unit size of data processing.

[0113] The parameter characteristics of the SM9 algorithm cover aspects such as elliptic curve parameters (such as curve equation coefficients, base points, etc.), bilinear pairing types, and master public keys. The elliptic curve parameters determine the mathematical structure on which the SM9 algorithm is based. Different curve parameters will affect the security and performance of operations such as encryption and signing. The purpose of obtaining these parameter characteristics is also to fully incorporate the unique imprint of the SM9 algorithm in this desensitization operation when generating the identification code, so that the identification code can reflect the application details of the SM9 algorithm, and facilitate the subsequent accurate and targeted identification and management of desensitized identity information based on the identification code.

[0114] The purpose of generating identification codes is to provide a unique and representative identification symbol for the desensitized identity information stored in the database. It can quickly and accurately identify and distinguish different desensitized identity information records among a large number of data. Moreover, since the identification code is generated based on the parameters and characteristics of the SM4 and SM9 algorithms, it is closely related to the specific encryption desensitization process, has high uniqueness and cannot be tampered with, and can effectively prevent data confusion, misoperation, and illegal access, and ensure the accurate management and safe use of desensitized identity information in the database.

[0115] The acquired SM4 algorithm parameters and SM9 algorithm parameter characteristics can be integrated and transformed through rules and algorithms. For example, different parameters are first extracted, encoded, or a specific mathematical structure (such as vectors, matrices, etc.) is constructed, and then after complex operations (such as encryption, hashing, mathematical function transformation, etc.), a unique identification code is finally generated. This identification code has key features that can reflect the use of SM4 and SM9 algorithms to desensitize the identity information, distinguishing it from the identification codes of other data.

[0116] By associating the generated identification code with the corresponding desensitized identity information in the database, the desensitized identity information is identified, so that in the process of managing and using the database, the corresponding desensitized identity information can be conveniently and quickly located, queried, verified and managed through the identification code. The implementation method may be to add a field for storing the identification code in the table structure design of the database for the record storing the desensitized identity information, or to establish a separate index table to associate and map the identification code with key information such as the storage location of the desensitized identity information.

[0117] In one embodiment, the algorithm parameters include a block length, a key length, and a number of encryption rounds, and the parameter characteristics include a base point coordinate value of an elliptic curve parameter and a computational efficiency index value of a bilinear pairing;

[0118] Based on the algorithm parameters and the parameter characteristics, generating an identification code includes:

[0119] Dynamically determine the weights of the packet length, key length, and number of encryption rounds based on the nonlinear complexity of the SM4 algorithm, the diffusion characteristics of the key expansion algorithm, and the degree of confusion of the round function, and perform weighted summation to obtain a first value;

[0120] Mapping the first numerical value onto a complex plane using a fractal function, extracting a quantized value from geometric features of the mapped fractal pattern, and converting the quantized value into a ternary sequence of a preset length;

[0121] The base point coordinate values ​​in the elliptic curve parameters are encrypted and compressed based on the lattice cipher, the compressed data is XORed with the computational efficiency index value of the bilinear pairing, and the XOR result is subjected to chaotic encryption mapping to obtain an encrypted sequence;

[0122] The ternary sequence is converted into a DNA base sequence according to a preset DNA coding rule, the encrypted sequence is used as the initial key of quantum encryption, the DNA base sequence is encoded and encrypted through the superposition state and entanglement state of quantum bits to obtain an identification code.

[0123] In this embodiment, the nonlinear complexity of the SM4 algorithm reflects the ability of the algorithm to hide the original characteristics of the data and increase the difficulty of cracking through nonlinear transformation during the encryption process; the diffusion characteristics of the key expansion algorithm are related to the propagation of the key information in the encryption rounds and the scope of influence on the plaintext data. The better the diffusion, the greater the influence of the small change of the plaintext on the ciphertext, and the higher the security; the degree of confusion of the round function reflects the effect of each round of encryption operation on the data disruption and confusion, making it difficult to analyze the correlation between the ciphertext and the plaintext. The weights of the packet length, key length, and number of encryption rounds are dynamically determined based on these key characteristics because the contribution of these parameters to the overall security and encryption effect is different in different encryption application scenarios. For example, in the identity information desensitization scenario with extremely high security requirements and large data volume, if the degree of confusion of the round function is more critical to ensuring security, the corresponding weight will be set higher, and by performing weighted summation in this way by dynamically adjusting the weight, a value that comprehensively reflects the core characteristics of the SM4 algorithm in this application can be accurately extracted according to the actual operation characteristics of the algorithm, that is, the first value.

[0124] The packet length, key length, and number of encryption rounds are multiplied by their dynamically determined weights and then added together to obtain a first value.

[0125] Fractal functions have unique mathematical properties such as self-similarity and infinitely fine structure. By mapping the first numerical value to the complex plane through the fractal function, the original single numerical information can be converted into a fractal representation with rich geometric structures and complex patterns. The above transformation takes advantage of the characteristics of fractal patterns that are complex and changeable and contain a lot of information, so that the characteristic information about the SM4 algorithm carried by the first numerical value is presented in a new, visual (from a geometric perspective) form. Different first numerical values ​​will generate completely different fractal patterns after being mapped by the fractal function, which in turn reflects the unique performance of different encryption parameter combinations at the fractal level, increasing the diversity and complexity of the data, and laying the foundation for the subsequent extraction of more unique identification codes.

[0126] Quantized values ​​are extracted from the geometric features of the mapped fractal pattern. For example, quantifiable geometric indicators such as the perimeter, area, and fractal dimension of the fractal pattern can be extracted. The above-mentioned quantized values ​​can accurately describe the characteristics of the fractal pattern in the form of numerical values, which indirectly reflects the first numerical value and the SM4 algorithm parameter characteristics behind it. The above-mentioned quantized values ​​are converted into a ternary sequence of a preset length. On the one hand, the purpose is to further normalize the data so that it has a unified format for subsequent fusion and encryption operations with other data. On the other hand, compared with commonly used systems such as binary, the ternary system has more state representations, which can provide a richer variation space in the subsequent encoding and encryption process, enhance the confidentiality and anti-cracking ability of the identification code, and at the same time, the setting of the preset length also helps to control the overall scale and structural stability of the identification code.

[0127] Lattice cryptography is a new cryptographic system based on lattice theory. It has the advantages of being resistant to quantum attacks, security based on mathematical problems (such as the shortest vector problem on the lattice, etc.), and relatively high encryption efficiency. The base point coordinate values ​​in the elliptic curve parameters are important basic data for the SM9 algorithm. Encryption compression based on lattice cryptography can, firstly, use the strong security of lattice cryptography to ensure the confidentiality of the base point coordinate values ​​during the processing process, and prevent them from being illegally obtained or tampered with; secondly, through encryption and compression operations, the amount of data can be reduced while ensuring the core characteristics of the data, making it easier for subsequent fusion and further encryption processing, and improving the efficiency of the entire identification code generation process and the convenience of data management.

[0128] The encrypted and compressed data is XORed with the computational efficiency index value of the bilinear pairing. The XOR operation can simply and effectively fuse data from two different sources, so that the information of the base point coordinate value processed by the grid password and the information about the performance characteristics of the SM9 algorithm contained in the computational efficiency index value of the bilinear pairing are intertwined, and the information of the two important parameter characteristics of the SM9 algorithm is preliminarily integrated. Then, the XOR operation result is subjected to chaotic encryption mapping. Chaotic encryption uses the characteristics of chaotic systems that are sensitive to initial conditions and have pseudo-randomness, and can further perform complex and nonlinear transformations on the XOR result, turning it into an encrypted sequence with high randomness and unpredictability, which greatly enhances the confidentiality of the data and makes it difficult for attackers to reverse the encryption sequence to obtain the original parameter information, ensuring the security and confidentiality of the SM9 algorithm parameter characteristics in the process of generating identification codes.

[0129] The above-mentioned DNA coding rules draw on the base combination mode of DNA molecules in the biological field, converting the ternary sequence into a DNA base sequence, so that the data is transformed from a digital sequence form into a sequence representation with bioinformatics characteristics. This conversion not only increases the novelty and uniqueness of the data representation, but also because the combination rules of DNA base sequences are relatively complex and the biological DNA in nature itself contains a huge amount of genetic information, it gives the data a more secretive coat, further enhancing the complexity and confidentiality of the data. At the same time, the DNA base sequence can be better combined with the characteristics of quantum bits in subsequent quantum encryption operations to achieve a higher level of encryption transformation.

[0130] Using the encryption sequence as the initial key of quantum encryption, and using the two unique quantum properties of quantum bits, the superposition state and the entangled state, to encode and encrypt the DNA base sequence, fully utilizes the super security advantage of quantum encryption. The superposition state of quantum bits allows them to be in a superposition of multiple states at the same time, and multiple encryption possibilities can exist simultaneously during the encryption process, greatly increasing the complexity of encryption; and the entangled state allows non-local correlations between different quantum bits. Even if the attacker obtains the information of some quantum bits, it is impossible to accurately infer the overall encryption situation. Through such quantum encryption operations, the DNA base sequence that has undergone multiple steps of processing and has a complex structure is finally encrypted and transformed. The generated identification code has extremely high security, uniqueness and anti-cracking capabilities, and can effectively identify the desensitized identity information in the database, building a solid defense line for the subsequent data management and security of the entire identity information dynamic desensitization method.

[0131] In one embodiment, based on the algorithm parameters and the parameter characteristics, an identification code is generated, specifically:

[0132] For the SM4 algorithm parameters, extract the packet length, key length, number of encryption rounds, and encryption mode. Construct a binary sequence of preset length based on the packet length value. For example, if the packet length is 128 bits, the first 8 bits of the binary sequence are the binary form of the hexadecimal representation of the packet length, the middle 8 bits are the binary form of the hexadecimal representation of the key length, and the last 8 bits are the binary representation of the number of encryption rounds. This is the basic data segment. According to the encryption mode, if it is the electronic codebook mode, add a specific 4-bit identification sequence "0101" at the end of the basic data segment; if it is the cipher block chaining mode, add "1010". Treat the obtained binary sequence as a long integer value, use this value as a seed, and generate a pseudo-random integer sequence. The sequence length is determined based on the number of elements of the S box in the SM4 algorithm. Count the ratio of the number of odd and even numbers in the sequence, and convert this ratio into an integer value within a specific range (such as 0 to 100) as a dimension parameter for subsequent graphics construction.

[0133] For the parameter characteristics of the SM9 algorithm, extract the curve equation coefficients, bilinear pairing type and master public key from the elliptic curve parameters. After sorting the curve equation coefficients, calculate the difference sequence of adjacent coefficients, and take the difference between the maximum and minimum values ​​in the difference sequence as a characteristic value. According to the bilinear pairing type, map it to a specific geometric figure. Use the first 8 bits of the hash value of the master public key as the side length to build a corresponding geometric figure (such as 5 after the hash value is converted to decimal, then build an equilateral triangle or square with a side length of 5), calculate the difference between the sum of the inner angles and the sum of the outer angles of the geometric figure, and use this difference as another dimension parameter.

[0134] Use the dimension parameter obtained by the above SM4 algorithm as the horizontal coordinate and the dimension parameter obtained by the SM9 algorithm as the vertical coordinate to determine a point on the two-dimensional plane. With this point as the center, determine whether to draw a circle or an ellipse according to the parity of the number of encryption rounds in the SM4 algorithm. If the number of encryption rounds is an odd number, draw a circle with a radius of one-tenth of the value of the key length of the SM4 algorithm; if it is an even number, draw an ellipse, the major semi-axis is the value of the last 8 bits of the hash value of the master public key of the SM9 algorithm converted to decimal, and the minor semi-axis is one-twentieth of the value of the group length of the SM4 algorithm. Sample the outline of the drawn figure, obtain the coordinates of several sampling points, connect these coordinate values ​​in a specific order into a closed polyline figure, calculate the number of vertices and the total length of the edges of the polyline figure, and combine these two values ​​into a new sequence.

[0135] The new sequence is encrypted based on blockchain encryption technology, and the values ​​therein are encrypted and signed using the public and private keys in the blockchain. The encryption and signature results are the final identification code.

[0136] In one embodiment, generating an identification code based on the algorithm parameters and the parameter characteristics includes:

[0137] The block length, key length and number of encryption rounds of the SM4 algorithm are extracted, and a hierarchical structure is constructed according to the block length value; the hierarchical structure is a binary tree. For example, if the block length is 128 bits, a binary tree with 128 nodes is constructed, and each node is initially marked as 0.

[0138] The path rule for switching marks in the binary tree is determined according to the key length value; for example, when the key length is 128 bits, starting from the root node, the mark is switched once (0 to 1 or vice versa) every time a node is passed according to the preset odd-even rule (such as odd layers to the right subtree, even layers to the left subtree). The number of encryption rounds determines the number of times the binary tree is traversed, as well as the starting node and direction of each traversal. After the above processing, the number of nodes marked as 1 in the binary tree and their depth information are counted, and the above information is integrated into a feature array.

[0139] For the SM9 algorithm, obtain the base point coordinate values ​​in the elliptic curve parameters and the computational efficiency index value of the bilinear pairing.

[0140] A two-dimensional matrix is ​​constructed based on the base point coordinate values. The number of rows and columns of the matrix are related to the absolute values ​​of the base point's horizontal and vertical coordinates (for example, if the absolute value of the horizontal coordinate is 10, the number of matrix rows is 10). In the matrix, the rules for filling elements are determined according to the computational efficiency index value of the bilinear pairing; for example, when the computational efficiency index value is within a certain range, specific symbols are filled in specific positions of the matrix (for example, asterisks are filled on the diagonal when the efficiency is high).

[0141] Perform specific logical comparison operations between rows and columns on the filled matrix; for example, compare the parity of the sum of the elements in each row and the product of the elements in each column, and convert the comparison result into a binary sequence.

[0142] The feature array obtained by the SM4 algorithm and the binary sequence obtained by the SM9 algorithm are fused. A dynamic splicing rule is used, which determines the starting position and alternating order of splicing based on the hash value of the current system timestamp. For example, when the first two digits of the hash value are 01, the first half of the feature array is taken first, and then the second half of the binary sequence is spliced ​​alternately; if it is 10, the opposite is true. After splicing, the fused sequence is obtained.

[0143] The fusion sequence is encrypted based on the semantic network. The semantic network is a form of knowledge representation, and a semantic network model related to cryptographic concepts and SM4 and SM9 algorithms is constructed here.

[0144] The elements in the fusion sequence are mapped to nodes or edges in the semantic network, and the sequence elements are recombined and transformed according to the logical relationship in the semantic network (such as the inheritance relationship of nodes, the connection weight of edges, etc.) to obtain the encrypted identification code. In this embodiment, the above method enables the generation logic of the identification code to be deeply integrated with the algorithm knowledge system, and has high dynamics and complexity, which improves security and uniqueness, and is effectively used for identification management of desensitized identity information.

[0145] Reference Figure 2 In one embodiment of the present invention, a dynamic desensitization system for identity information based on SM4 and SM9 algorithms is provided, comprising:

[0146] The segmentation module is used to segment the original identity information into sensitive segment information and common segment information;

[0147] An encryption module, used for dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein the keys are dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed;

[0148] A conversion module, used to extract the characteristic value of the common segment information through a preset hash function, and convert the characteristic value into coded data in a preset format to obtain converted common segment information;

[0149] A splicing module, used for splicing the converted common segment information and the encrypted sensitive segment information according to a pre-set splicing sequence rule determined based on the parity of the number of encryption rounds of the SM4 algorithm to obtain preliminary desensitized data;

[0150] The desensitizing module is used to encrypt the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, and embed the unique identity identifier associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information.

[0151] In this embodiment, for the specific implementation of each module in the above system embodiment, please refer to the above method embodiment, which will not be repeated here.

[0152] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0153] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0154] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0155] In summary, the method and system for dynamic desensitization of identity information based on SM4 and SM9 algorithms provided in the embodiment of the present invention include: segmenting the original identity information to obtain sensitive segment information and ordinary segment information; dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein, dynamically generating keys by collecting real-time operating parameters and combining with a preset basic key seed; extracting the characteristic value of the ordinary segment information through a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted ordinary segment information; splicing the converted ordinary segment information and the encrypted sensitive segment information according to a pre-set splicing order rule determined by the parity of the number of encryption rounds based on the SM4 algorithm to obtain preliminary desensitized data; encrypting the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, and embedding the unique identity associated with the original identity information in the encrypted ciphertext in an encrypted manner to obtain desensitized identity information. In the present invention, by combining the SM4 and SM9 algorithms, not only can dynamic desensitization of identity information be achieved, but also the data format can be kept unchanged. It overcomes the defects of the current desensitization algorithm that it cannot dynamically adjust the desensitization strategy and destroys the original format of the data.

[0156] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0157] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0158] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A dynamic desensitization method for identity information based on SM4 and SM9 algorithms, characterized in that: The following steps are involved: The original identity information is segmented into sensitive segment information and common segment information; Dynamically generate a key based on the SM4 algorithm, and encrypt the sensitive segment information to obtain encrypted sensitive segment information; wherein the key is dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed; Extracting characteristic values ​​of the common segment information by using a preset hash function, and converting the characteristic values ​​into coded data in a preset format to obtain converted common segment information; According to a pre-set splicing order rule determined based on the parity of the number of encryption rounds of the SM4 algorithm, the converted common segment information and the encrypted sensitive segment information are spliced ​​to obtain preliminary desensitized data; Encrypting the preliminary desensitized data based on the SM9 algorithm to generate encrypted ciphertext, and embedding the unique identity identifier associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information; The dynamic key generation based on the SM4 algorithm includes: Real-time acquisition of timestamp information, current processing data volume information, and network connection status information as real-time operation parameters; Performing an XOR operation on a preset basic key seed and the timestamp information to obtain a first intermediate value; Performing a bit-joining operation on the first intermediate value and the currently processed data volume information to obtain a second intermediate value; Performing a cyclic shift mixing operation on the second intermediate value and the network connection state information to obtain a final dynamic key; The pre-set splicing order rule based on the parity of the number of encryption rounds of the SM4 algorithm includes: Determine the parity of the number of encryption rounds performed when the SM4 algorithm encrypts sensitive segment information; If the number of encryption rounds is an odd number, the converted common segment information is grouped in a back-to-front order, with three bytes in each group, and the encrypted sensitive segment information is grouped in a front-to-back order, with four bytes in each group; a group of converted common segment information and a group of encrypted sensitive segment information are alternately selected for splicing, and a two-byte connection identifier generated by the encryption algorithm based on the current system process ID and the network session port number is inserted between the two groups of data during splicing; If the number of encryption rounds is even, the converted common segment information is grouped in a front-to-back order, with five bytes as a group, and the encrypted sensitive segment information is grouped in a back-to-front order, with three bytes as a group. A group of encrypted sensitive segment information and a group of converted common segment information are alternately selected for splicing. When splicing, a three-byte separator obtained by hashing the current system timestamp and a randomly generated three-bit check code is inserted between the two groups of data.

2. The method for dynamic desensitization of identity information based on SM4 and SM9 algorithms according to claim 1 is characterized in that: The data format of the desensitized identity information is the same as the data format of the original identity information; The original identity information includes geographic information, contact information, and ID number.

3. The method for dynamic desensitization of identity information based on SM4 and SM9 algorithms according to claim 1, characterized in that: Extracting the characteristic value of the common segment information by a preset hash function, and converting the characteristic value into coded data in a preset format to obtain converted common segment information, including: Selecting a hash function combination with anti-collision and high hash distribution, wherein the hash function combination includes two hash algorithms with different construction principles; Inputting the common segment information into the hash function combination in sequence to extract feature values; An interleaving algorithm based on the error correction coding principle is used to concatenate and fuse the eigenvalues ​​output by each round of hash functions to obtain a fused eigenvalue. The fused feature value is converted according to a preset coding mapping table to obtain converted common segment information.

4. The method for dynamic desensitization of identity information based on SM4 and SM9 algorithms according to claim 3 is characterized in that: In the feature value extraction process of each round of hash function in the hash function combination, a random salt value is introduced, and the random salt value is generated by a confusion function based on the current hardware identification information and the real-time timestamp information; The preset coding mapping table is constructed based on discrete logarithmic transformation on a finite field, and maps the characteristic value to coded data in a preset format, thereby obtaining converted common segment information.

5. The method for dynamic desensitization of identity information based on SM4 and SM9 algorithms according to claim 1, characterized in that: After obtaining the desensitized identity information, the following steps are included: Storing the desensitized identity information in a database; Obtaining algorithm parameters of the SM4 algorithm and parameter characteristics of the SM9 algorithm; generating an identification code based on the algorithm parameters and the parameter characteristics; The desensitized identity information in the database is identified based on the identification code.

6. The method for dynamic desensitization of identity information based on SM4 and SM9 algorithms according to claim 5 is characterized in that: The algorithm parameters include packet length, key length, and number of encryption rounds, and the parameter characteristics include base point coordinate values ​​of elliptic curve parameters and computational efficiency index values ​​of bilinear pairings; Based on the algorithm parameters and the parameter characteristics, generating an identification code includes: Dynamically determine the weights of the packet length, key length, and number of encryption rounds based on the nonlinear complexity of the SM4 algorithm, the diffusion characteristics of the key expansion algorithm, and the degree of confusion of the round function, and perform weighted summation to obtain a first value; Mapping the first numerical value onto a complex plane using a fractal function, extracting a quantized value from geometric features of the mapped fractal pattern, and converting the quantized value into a ternary sequence of a preset length; The base point coordinate values ​​in the elliptic curve parameters are encrypted and compressed based on the lattice cipher, the compressed data is XORed with the computational efficiency index value of the bilinear pairing, and the XOR result is subjected to chaotic encryption mapping to obtain an encrypted sequence; The ternary sequence is converted into a DNA base sequence according to a preset DNA coding rule, the encrypted sequence is used as the initial key of quantum encryption, the DNA base sequence is encoded and encrypted through the superposition state and entanglement state of quantum bits to obtain an identification code.

7. A dynamic desensitization system for identity information based on SM4 and SM9 algorithms, characterized in that: include: The segmentation module is used to segment the original identity information into sensitive segment information and common segment information; An encryption module, used for dynamically generating keys based on the SM4 algorithm, and encrypting the sensitive segment information to obtain encrypted sensitive segment information; wherein the keys are dynamically generated by collecting real-time operating parameters and combining with a preset basic key seed; A conversion module, used to extract the characteristic value of the common segment information through a preset hash function, and convert the characteristic value into coded data in a preset format to obtain converted common segment information; A splicing module, used for splicing the converted common segment information and the encrypted sensitive segment information according to a pre-set splicing sequence rule determined based on the parity of the number of encryption rounds of the SM4 algorithm to obtain preliminary desensitized data; A desensitizing module, used for encrypting the preliminary desensitized data to generate encrypted ciphertext based on the SM9 algorithm, and embedding the unique identity identifier associated with the original identity information into the encrypted ciphertext in an encrypted manner to obtain desensitized identity information; The dynamic key generation based on the SM4 algorithm includes: Real-time acquisition of timestamp information, current processing data volume information, and network connection status information as real-time operation parameters; Performing an XOR operation on a preset basic key seed and the timestamp information to obtain a first intermediate value; Performing a bit-joining operation on the first intermediate value and the currently processed data volume information to obtain a second intermediate value; Performing a cyclic shift mixing operation on the second intermediate value and the network connection state information to obtain a final dynamic key; The pre-set splicing order rule based on the parity of the number of encryption rounds of the SM4 algorithm includes: Determine the parity of the number of encryption rounds performed when the SM4 algorithm encrypts sensitive segment information; If the number of encryption rounds is an odd number, the converted common segment information is grouped in a back-to-front order, with three bytes in each group, and the encrypted sensitive segment information is grouped in a front-to-back order, with four bytes in each group; a group of converted common segment information and a group of encrypted sensitive segment information are alternately selected for splicing, and a two-byte connection identifier generated by the encryption algorithm based on the current system process ID and the network session port number is inserted between the two groups of data during splicing; If the number of encryption rounds is even, the converted common segment information is grouped in a front-to-back order, with five bytes as a group, and the encrypted sensitive segment information is grouped in a back-to-front order, with three bytes as a group. A group of encrypted sensitive segment information and a group of converted common segment information are alternately selected for splicing. When splicing, a three-byte separator obtained by hashing the current system timestamp and a randomly generated three-bit check code is inserted between the two groups of data.

8. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images