Data outbound consistency verification method and system

Abstract

The invention relates to a data outbound consistency verification method and system, and the method comprises the steps: extracting outbound data and constructing an auditing log and a statistical log by a data processing side consistency verification subsystem according to an outbound data strategy file and an outbound verification rule file which are confirmed through joint auditing and according to the outbound data strategy file; then, a consistency verification subsystem at a verification side performs consistency verification on the audit logs and the statistical logs by applying a privacy computing technology according to an exit verification rule file, and designs a corresponding system, and a consistency verification subsystem at a data processing side carries an exit data log extraction module and a privacy computing node to complete consistency verification of the audit logs and the statistical logs. And the verification side consistency verification subsystem carries a data exit verification rule configuration module and a privacy computing node, so that the consistency verification of the exit data and the exit data declaration material is realized under the condition that the original exit data is not exposed, the safety of the data exit consistency verification work is improved, and the data exit consistency verification efficiency is improved. And the legitimate rights and interests of the data processor are effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to a method and system for verifying consistency of outbound data, belonging to the technical field of outbound data verification. Background Art

[0002] At present, the country attaches great importance to the development of the digital economy. Data has become a new production factor, on par with traditional factors such as land, labor, capital and technology. Data exerts its value through flow. Data flow is a key factor in promoting the digital economy and digital trade. In the fields of cross-border scientific research, exchanges, trade, etc., cross-border data flow enables enterprises to make full use of global factor resources and generate huge economic value and social benefits. In this process, the country attaches great importance to the security of cross-border data flow, strictly manages the cross-border flow of relevant data such as personal information and important data, regulates data outbound activities, and promotes convenient, safe and compliant cross-border flow of data.

[0003] When data processors are involved in the export of important data or personal information data of a certain scenario or scale, they need to declare the negative list of the free trade pilot zone, the filing of the standard contract for the export of personal information, or the declaration of the data export security assessment to the cyberspace administration department. Only after passing the declaration can they carry out data export activities. The declaration materials must list the field composition of the export data, the data classification and grading results, and the data scale. In the actual work process after the declaration is approved, both the data processors themselves and the regulatory authorities have the need to verify the consistency of the actual export data of the data processors with the declaration materials, so as to supervise whether the data processors strictly export data according to the declaration scope and avoid illegal data export. Therefore, the research and formation of technical solutions for consistency verification of data export has become an important part of supporting the development of related work. In this context, when providing consistency verification of export data, data processors generally have concerns about the leakage of original data and the lack of automated means to support the verification process, which need to be solved urgently.

[0004] At present, the consistency verification of data outbound is mainly carried out by experts through offline verification. After the data processor submits the application materials and is approved, a table of the fields of the data outbound is formed. When the data outbound activities are carried out, the actual outbound data content is formed. Therefore, through the verification and comparison of experts, it is determined whether there are data outbound activities that exceed the scope of the declaration. This solution relies on manual verification, and there are doubts about the efficiency of execution and the objectivity of the results. At the same time, this solution is difficult to solve problems such as how to give the original outbound data to experts for verification and how to ensure that there are no information leaks during the verification process. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a data outbound consistency verification method, which performs data extraction and consistency verification based on the outbound data strategy file and the outbound verification rule file, thereby improving the security of data outbound and the work efficiency of verification.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions: the present invention designs a method for verifying the consistency of data outbound transmission, according to the outbound data policy file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side, and the outbound data declaration materials uploaded by the corresponding data processor and the outbound verification rule file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side, for the outbound data sent by the data processor through the data outbound business system, the consistency verification subsystem on the data processing side extracts the content of each target field corresponding to the outbound data according to the extraction strategy of each target field in the outbound data policy file, and constructs an audit log and a statistical log; then the consistency verification subsystem on the verification and inspection side applies privacy computing technology according to the outbound verification rule file to perform consistency verification on the audit log and the statistical log.

[0007] As a preferred technical solution of the present invention: the outbound data policy file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side is obtained according to the following steps A1 to A3; Step A1. The consistency verification subsystem on the data processing side configures the outbound data policy file including the outbound data business scenario, target output location, extraction strategy for each target field, and preset mapping relationships between each target field and important data category, sensitive personal information category, and non-sensitive personal information category, based on the outbound data to be sent by the data processor through the data outbound business system. The extraction strategy for each target field includes the preset extraction location, extraction range, and preset verification rules for each target field corresponding to the outbound data, and then proceeds to step A2; Step A2. The consistency verification subsystem on the data processing side sends the outbound data policy file to the consistency verification subsystem on the verification and inspection side, which reviews the outbound data policy file. If the review is confirmed, the review confirmation result is fed back to the consistency verification subsystem on the data processing side, and the consistency verification subsystem on the data processing side signs the outbound data policy file through the digital certificate signature system; if the review is not confirmed, the unconfirmed content in the outbound data policy file is returned to the consistency verification subsystem on the data processing side, and the process goes to step A3; Step A3. The consistency verification subsystem on the data processing side reconfigures the unconfirmed contents in the outbound data policy file according to the outbound data to be sent by the data processor through the outbound data business system, updates the outbound data policy file, and then returns to step A2.

[0008] As a preferred technical solution of the present invention: in the step A2, the consistency verification subsystem on the verification inspection side performs a review on the outbound data policy file according to the following steps A2-1 to A2-3; Rule A2-1. For each target field in the outbound data strategy file, determine whether the target field meets the target specification standard, and whether the target field matches its corresponding extraction scope and preset verification rules. If both judgments are yes, proceed to step A2-2; if both judgments are no, the outbound data strategy file is not confirmed by the review, and the contents of the unconfirmed review are determined; Rule A2-2. According to the target fields in the outbound data strategy file, determine whether the outbound data business scenario in the outbound data strategy file is correct. If it is correct, proceed to step A2-3; otherwise, the outbound data strategy file is not confirmed by the review, and the contents of the review that are not confirmed are determined; Step A2-3. Determine whether the storage space of the target output location in the outbound data policy file is greater than the preset storage threshold space, and determine whether the security protection level corresponding to the target output location meets the preset security threshold level. If both judgments are yes, the outbound data policy file is reviewed and confirmed; if both judgments are no, the outbound data policy file is reviewed and not confirmed, and the content of the review and not confirmed is determined.

[0009] As a preferred technical solution of the present invention: for the outbound data sent by the data processor via the data outbound business system, the consistency verification subsystem on the data processing side extracts the content of each target field corresponding to the outbound data according to the extraction strategy of each target field in the outbound data policy file, and verifies the content of each extracted target field according to the preset verification rules in the extraction strategy of each target field, discards the content that fails the verification, obtains the content that passes the verification, and then builds an audit log in combination with the outbound data business scenario, the domestic business system IP address corresponding to the outbound data, the overseas recipient IP address, and the data transmission time; Then, the consistency verification subsystem on the data processing side counts the total number of bytes of the content of each target field corresponding to the important data category, the sensitive personal information category, and the non-sensitive personal information category according to the mapping relationship between each target field preset in the outbound data policy file, and counts the total number of people involved in the content of each target field corresponding to the important data category after duplication, and constructs a statistical log; Finally, the audit log and statistical log are output to the target output location in the outbound data strategy file.

[0010] As a preferred technical solution of the present invention: the exit data declaration materials uploaded by the corresponding data processor and the exit verification rule file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side are obtained according to the following steps B1 to B3; Step B1. The consistency verification subsystem on the verification and inspection side configures the outbound verification rule file based on the outbound data declaration materials uploaded by the data processor, including the outbound data business scenario corresponding to the outbound data declaration materials, the content of each target field, the total number of bytes of the content of each target field corresponding to the important data category, the total number of people involved in the content of each target field corresponding to the sensitive personal information category and the non-sensitive personal information category after deduplication, as well as the corresponding domestic business system IP address, the overseas recipient IP address, and the data transmission time, and then proceeds to step B2; Step B2. The consistency verification subsystem on the verification and inspection side sends the exit verification rule file to the consistency verification subsystem on the data processing side, which verifies whether the exit verification rule file is consistent with the exit data declaration materials. If so, it will be reviewed and confirmed, and the review and confirmation result will be fed back to the consistency verification subsystem on the verification and inspection side, which will sign the exit verification rule file through the digital certificate signature system; otherwise, if the review is not confirmed, the unconfirmed content in the exit verification rule file will be returned to the consistency verification subsystem on the verification and inspection side, and the process goes to step B3; Step B3. The consistency verification subsystem on the verification and inspection side reconfigures the unconfirmed contents in the outbound verification rule file based on the outbound data declaration materials uploaded by the data processor, updates the outbound verification rule file, and then returns to step B2.

[0011] As a preferred technical solution of the present invention: the consistency verification subsystem on the verification inspection side applies privacy computing technology according to the exit verification rule file, and performs the following steps I to II to perform consistency verification on the audit log and the statistical log; Step I. Verification and inspection side: The consistency verification subsystem compares the contents of each target field in each outbound data business scenario in the audit log with the contents of each target field in the corresponding outbound data business scenario in the outbound verification rule file based on the privacy intersection algorithm, and gives a conclusion on whether the contents of each target field in the audit log exceed the outbound data declaration materials, with a mark of 1 for exceeding and a mark of 0 for not exceeding; The consistency verification subsystem on the verification and inspection side compares the data outbound communication link formed by the IP address of the domestic business system and the IP address of the overseas recipient in each outbound data business scenario in the audit log based on the privacy intersection algorithm according to the outbound verification rule file and the data outbound communication link in the corresponding outbound data business scenario in the outbound verification rule file, and gives a conclusion on whether the data outbound communication link in the audit log exceeds the outbound data declaration materials, with a mark of 1 if it exceeds and a mark of 0 if it does not exceed. The consistency verification subsystem on the verification inspection side determines, based on the outbound verification rule file and the comparison algorithm of privacy computing, whether the total number of bytes of the target fields of the important data categories in the statistical logs for each outbound data business scenario exceeds the total number of bytes of the target fields of the important data categories in the corresponding outbound data business scenario in the outbound verification rule file. If yes, it exceeds and is marked as 1; otherwise, it does not exceed and is marked as 0; The consistency verification subsystem on the verification inspection side shall determine, based on the comparison algorithm of privacy computing and the outbound verification rule file, whether the total number of people after deduplication involved in the target field content of the sensitive personal information category and the non-sensitive personal information category in each outbound data business scenario in the statistical log exceeds the total number of people after deduplication involved in the target field content of the sensitive personal information category and the non-sensitive personal information category in the corresponding outbound data business scenario in the outbound verification rule file. If so, it exceeds and is marked as 1; otherwise, it does not exceed and is marked as 0; Then proceed to step II; Step II. Verification and inspection side The consistency verification subsystem performs weighted processing on the tag value of each comparison result according to the preset weights corresponding to each comparison in step I, and obtains the outbound violation risk value corresponding to the audit log and the statistical log.

[0012] As a preferred technical solution of the present invention: it also includes applying blockchain technology to the outbound data policy file, the outbound verification rule file, and the outbound violation risk values ​​corresponding to the audit log and the statistical log, and executing on-chain evidence storage.

[0013] Corresponding to the above, the technical problem that the present invention also needs to solve is to provide a system for data outbound consistency verification method, and a modular design architecture realizes the execution of the design method, thereby improving the security of data outbound and the efficiency of verification.

[0014] In order to solve the above technical problems, the present invention adopts the following technical solutions: the present invention designs a system of a data outbound consistency verification method, including a data processing side consistency verification subsystem, a verification and inspection side consistency verification subsystem, and a data outbound business system. The data processing side consistency verification subsystem includes an outbound data log extraction module and a privacy computing node, and the verification and inspection side consistency verification subsystem includes a data outbound verification rule configuration module and a privacy computing node; The outbound data log extraction module in the consistency verification subsystem on the data processing side is used to execute steps A1 and A3 to configure the outbound data policy file, execute the review of the outbound verification rule file in step B2, execute the signing of the outbound data policy file through the digital certificate signature system in step A2, and extract the content of each target field of the outbound data according to the extraction strategy of each target field in the outbound data policy file, and construct the audit log and the statistical log; The privacy computing node in the consistency verification subsystem on the data processing side is used as the target output location in the outbound data policy file to receive audit logs and statistical logs; The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side is used to execute steps B1 and B3 to configure the outbound verification rule file, execute the review of the outbound data policy file in step A2, and execute step B2 to sign the outbound verification rule file through the digital certificate signature system; The privacy computing node in the consistency verification subsystem on the verification check side is used to receive the signed outbound verification rule file; The data outbound business system is used to provide outbound data sending services to data processors; The consistency verification subsystem on the verification inspection side applies privacy computing technology based on the outbound verification rule file in its privacy computing node to perform consistency verification on the audit logs and statistical logs in the privacy computing node of the consistency verification subsystem on the data processing side.

[0015] As a preferred technical solution of the present invention: it also includes a blockchain system, and the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side also include a blockchain evidence storage module, wherein the blockchain evidence storage module in the consistency verification subsystem on the data processing side is used to receive the outbound data policy file from the outbound data log extraction module, the outbound violation risk value corresponding to the audit log and statistical log from the corresponding privacy computing node, and forward the blockchain system to execute on-chain evidence storage; The blockchain evidence module in the consistency verification subsystem on the verification and inspection side is used to receive the outbound verification rule file from the data outbound verification rule configuration module, the outbound violation risk value corresponding to the audit log and statistical log from the corresponding privacy computing node, and forward it to the blockchain system to execute on-chain evidence.

[0016] The data outbound consistency verification method and system described in the present invention, using the above technical solution, has the following technical effects compared with the prior art: The present invention designs a method for verifying the consistency of data outbound transmission. According to the outbound data policy file and the outbound verification rule file confirmed by the joint audit, the consistency verification subsystem on the data processing side extracts the contents of each target field of the outbound data according to the outbound data policy file, and constructs an audit log and a statistical log; then the consistency verification subsystem on the verification and inspection side applies the privacy computing technology according to the outbound verification rule file to perform consistency verification on the audit log and the statistical log, and designs a corresponding system, with the consistency verification subsystem on the data processing side equipped with an outbound data log extraction module and a privacy computing node, and the consistency verification subsystem on the verification and inspection side equipped with a data outbound verification rule configuration module and a privacy computing node, so as to realize the consistency verification of the outbound data and the outbound data declaration materials without exposing the original outbound data, thereby improving the security of the data outbound consistency verification work and effectively protecting the legitimate rights and interests of the data processors; The present invention designs a method for verifying the consistency of data outbound transmission, proposes an outbound data policy file and review conditions for automatically generating audit logs and statistical logs, and proposes a standard format and review conditions for outbound verification rule files. It also implements integrity protection for policy files and rule files based on digital signatures and blockchain technology, thereby improving the fairness and objectivity of consistency verification activities and having better legal effect. It also uses privacy computing technology to implement verification processes, privacy computing task design, and risk score calculation methods to ensure the security of verification activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the system architecture of the method for verifying the consistency of outbound design data of the present invention; Figure 2 It is a flow chart of the method for verifying the consistency of outbound design data of the present invention. DETAILED DESCRIPTION

[0018] The specific implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0019] The present invention designs a data outbound consistency verification method and system, which are used to verify the data outbound behavior of data processors. In actual application, the designed system includes a data processing side consistency verification subsystem, a verification and inspection side consistency verification subsystem, a data outbound business system, and a blockchain system. The data processing side consistency verification subsystem includes an outbound data log extraction module, a privacy computing node, and a blockchain evidence module. The verification and inspection side consistency verification subsystem includes a data outbound verification rule configuration module, a privacy computing node, and a blockchain evidence module.

[0020] In actual application of the method for designing consistency verification of data outbound transmission, firstly execute the following steps A1 to A3 to obtain the outbound data policy file that has been jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side.

[0021] Step A1. The outbound data log extraction module in the consistency verification subsystem on the data processing side configures the outbound data policy file including the outbound data business scenario, target output location, extraction strategy for each target field, and preset mapping relationships between each target field and important data category, sensitive personal information category, and non-sensitive personal information category, based on the outbound data to be sent by the data processor through the data outbound business system. The extraction strategy for each target field includes preset extraction locations, extraction ranges, and preset verification rules for outbound data corresponding to each target field, and then proceeds to step A2.

[0022] In actual applications, the target fields are such as the ID number field, gender field, etc. The preset verification rule corresponding to the ID number field is an 18-digit value, and the preset verification rule corresponding to the gender field is the value range of "male" or "female".

[0023] Step A2. The outbound data log extraction module in the consistency verification subsystem on the data processing side sends the outbound data policy file to the outbound data verification rule configuration module in the consistency verification subsystem on the verification inspection side. The outbound data verification rule configuration module reviews the outbound data policy file. If the review is confirmed, the review confirmation result is fed back to the outbound data log extraction module in the consistency verification subsystem on the data processing side. The outbound data log extraction module signs the outbound data policy file through the digital certificate signature system. If the review is not confirmed, the unconfirmed content in the outbound data policy file is returned to the outbound data log extraction module in the consistency verification subsystem on the data processing side, and the process goes to step A3.

[0024] In actual application of the above step A2, the data outbound verification rule configuration module in the consistency verification subsystem on the verification and inspection side performs a review on the outbound data policy file according to the following steps A2-1 to A2-3.

[0025] Rule A2-1. The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side determines, for each target field in the outbound data policy file, whether the target field complies with the target specification standard, and whether the target field matches its corresponding extraction scope and preset verification rule. If both judgments are yes, proceed to step A2-2; if both judgments are no, the outbound data policy file is not confirmed by the review, and the contents of the unconfirmed review are determined; Rule A2-2. The data outbound verification rule configuration module in the consistency verification subsystem on the verification check side determines whether the outbound data business scenario in the outbound data policy file is correct based on the target fields in the outbound data policy file. If so, proceed to step A2-3; otherwise, the outbound data policy file review is not confirmed, and the contents of the review that are not confirmed are determined; Step A2-3. The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side determines whether the storage space of the target output location in the outbound data policy file is greater than the preset storage threshold space, and determines whether the security protection level corresponding to the target output location meets the preset security threshold level. If both judgments are yes, the outbound data policy file is reviewed and confirmed. The security protection level is used to prevent the audit log and statistical log from being deleted or tampered with. If both judgments are no, the outbound data policy file is reviewed and not confirmed, and the content of the review and not confirmed is determined.

[0026] Step A3. The outbound data log extraction module in the consistency verification subsystem on the data processing side reconfigures the outbound data policy file for the unconfirmed content in the outbound data policy file based on the outbound data to be sent by the data processor through the outbound data business system, updates the outbound data policy file, and then returns to step A2.

[0027] The outbound data policy file, which has been jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side and signed by the digital certificate signature system, ensures the integrity and non-repudiation of the outbound data policy file. The outbound data policy file defines a mapping relationship for converting the outbound data in the data outbound activities carried out by the data processor into audit logs and statistical logs for consistency verification. Therefore, the outbound data policy file determines the key to the accuracy and comprehensiveness of the audit logs and statistical logs.

[0028] At the same time, the following steps B1 to B3 are executed to obtain the outbound data declaration materials uploaded by the corresponding data processor and the outbound verification rule file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification inspection side.

[0029] Step B1. The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side configures the outbound verification rule file based on the outbound data declaration materials uploaded by the data processor, including the outbound data business scenario corresponding to the outbound data declaration materials, the content of each target field, the total number of bytes of the content of each target field corresponding to the important data category, the total number of people involved in the deduplication of the content of each target field corresponding to the sensitive personal information category and the non-sensitive personal information category, as well as the corresponding domestic business system IP address, the overseas recipient IP address, and the data transmission time, and then proceeds to step B2.

[0030] Step B2. The data outbound verification rule configuration module in the consistency verification subsystem on the verification and inspection side sends the outbound verification rule file to the outbound data log extraction module in the consistency verification subsystem on the data processing side. The outbound data log extraction module reviews whether the outbound verification rule file is consistent with the outbound data declaration materials. If so, it will be reviewed and confirmed, and the review and confirmation result will be fed back to the data outbound verification rule configuration module in the consistency verification subsystem on the verification and inspection side. The data outbound verification rule configuration module will sign the outbound verification rule file through the digital certificate signature system and send it to the privacy computing node in the consistency verification subsystem on the verification and inspection side. Otherwise, if the review is not confirmed, the unconfirmed content in the outbound verification rule file will be returned to the data outbound verification rule configuration module in the consistency verification subsystem on the verification and inspection side, and the process goes to step B3.

[0031] Step B3. The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side reconfigures the unconfirmed contents in the outbound verification rule file based on the outbound data declaration materials uploaded by the data processor, updates the outbound verification rule file, and then returns to step B2.

[0032] In this way, the exit verification rules document is jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification inspection side, and signed by the digital certificate signature system, thus ensuring the integrity and non-repudiation of the exit verification rules document.

[0033] Then, for the outbound data sent by the data processor through the data outbound business system, the outbound data log extraction module of the consistency verification subsystem on the data processing side extracts the contents of each target field corresponding to the outbound data according to the extraction strategies of each target field in the outbound data policy file, and verifies the contents of each extracted target field according to the preset verification rules in the extraction strategy of each target field, discards the contents that fail the verification, obtains the contents that pass the verification, and then constructs the audit log in combination with the outbound data business scenario, the domestic business system IP address corresponding to the outbound data, the overseas recipient IP address, and the data transmission time.

[0034] Then, the outbound data log extraction module of the consistency verification subsystem on the data processing side counts the total number of bytes of the content of each target field corresponding to the important data category, the total number of people involved in the content of each target field corresponding to the sensitive personal information category and the non-sensitive personal information category after deduplication, based on the mapping relationship between the target fields preset in the outbound data policy file and the important data category, and constructs a statistical log.

[0035] The outbound data log extraction module in the consistency verification subsystem on the data processing side outputs the audit log and statistical log to the privacy computing node in the consistency verification subsystem on the data processing side. In this way, the audit log and statistical log are generated according to the outbound data policy file, which can ensure the integrity and non-repudiation of the log.

[0036] Finally, the consistency verification subsystem on the verification inspection side applies privacy computing technology according to the outbound verification rule file in its privacy computing node, and executes the following steps I to II to perform consistency verification on the audit log and statistical log in the privacy computing node of the consistency verification subsystem on the data processing side.

[0037] Step I. Verification and inspection side: The consistency verification subsystem compares the contents of each target field in each outbound data business scenario in the audit log with the contents of each target field in the outbound data business scenario in the outbound verification rule file based on the privacy intersection algorithm according to the outbound verification rule file in its privacy computing node, and gives a conclusion on whether the contents of each target field in the audit log exceed the outbound data declaration materials, with a mark of 1 for exceeding and a mark of 0 for not exceeding; The consistency verification subsystem on the verification and inspection side compares the data outbound communication link formed by the IP address of the domestic business system and the IP address of the overseas recipient in each outbound data business scenario in the audit log with the data outbound communication link in the corresponding outbound data business scenario in the outbound verification rule file based on the privacy intersection algorithm according to the outbound verification rule file in its privacy computing node, and gives a conclusion on whether the data outbound communication link in the audit log exceeds the outbound data declaration materials, and marks it as 1 if it exceeds, and 0 if it does not exceed; The consistency verification subsystem on the verification inspection side determines, based on the outbound verification rule file in its privacy computing node and the privacy computing comparison algorithm, whether the total number of bytes of the target fields corresponding to the important data categories in each outbound data business scenario in the statistical log exceeds the total number of bytes of the target fields corresponding to the important data categories in the corresponding outbound data business scenario in the outbound verification rule file. If yes, it exceeds and is marked as 1; otherwise, it does not exceed and is marked as 0; The consistency verification subsystem on the verification inspection side determines, based on the outbound verification rule file in its privacy computing node and the privacy computing comparison algorithm, whether the total number of people after duplication involved in the target field content of the sensitive personal information category and the non-sensitive personal information category in each outbound data business scenario in the statistical log exceeds the total number of people after duplication involved in the target field content of the sensitive personal information category and the non-sensitive personal information category in the corresponding outbound data business scenario in the outbound verification rule file. If so, it exceeds and is marked as 1; otherwise, it does not exceed and is marked as 0; Then proceed to step II; Step II. Verification and inspection side The consistency verification subsystem performs weighted processing on the tag value of each comparison result according to the preset weights corresponding to each comparison in step I, and obtains the outbound violation risk value corresponding to the audit log and the statistical log.

[0038] In the actual application of the above design scheme, the outbound data policy file signed in the outbound data log extraction module in the consistency verification subsystem on the data processing side is forwarded to the blockchain system through the corresponding blockchain evidence module for chain storage, and the outbound violation risk value corresponding to the audit log and statistical log in the privacy computing node in the consistency verification subsystem on the data processing side is forwarded to the blockchain system through the corresponding blockchain evidence module for chain storage.

[0039] At the same time, the outbound verification rule file signed in the data outbound verification rule configuration module in the consistency verification subsystem on the verification and inspection side is forwarded to the blockchain system through the corresponding blockchain evidence module for chain storage, and the outbound violation risk value corresponding to the audit log and statistical log in the privacy computing node in the consistency verification subsystem on the verification and inspection side is forwarded to the blockchain system through the corresponding blockchain evidence module for chain storage.

[0040] The data outbound consistency verification method designed by the above technical solution is based on the outbound data policy file and the outbound verification rule file confirmed by the joint review. The consistency verification subsystem on the data processing side extracts the contents of each target field of the outbound data according to the outbound data policy file, and constructs the audit log and the statistical log; then the consistency verification subsystem on the verification and inspection side applies the privacy computing technology according to the outbound verification rule file to perform consistency verification on the audit log and the statistical log, and designs a corresponding system, with the consistency verification subsystem on the data processing side equipped with the outbound data log extraction module and the privacy computing node, and the consistency verification subsystem on the verification and inspection side equipped with the data outbound verification rule configuration module and the privacy computing node. Without exposing the original outbound data, the consistency verification of the outbound data and the outbound data declaration materials is realized, thereby improving the security of the data outbound consistency verification work and effectively protecting the legitimate rights and interests of the data processors.

[0041] The present invention also proposes outbound data policy files and review conditions for the automatic generation of audit logs and statistical logs, and proposes a standard format and review conditions for outbound verification rule files, and implements integrity protection for policy files and rule files based on digital signatures and blockchain technology, thereby improving the fairness and objectivity of consistency verification activities and having better legal effect. It also uses privacy computing technology to implement verification processes, privacy computing task design, and risk score calculation methods to ensure the security of verification activities.

[0042] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

Claims

1. A method for verifying consistency of data outbound transmission, characterized in that: According to the outbound data policy file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side, as well as the outbound data declaration materials uploaded by the corresponding data processor and the outbound verification rule file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side, for the outbound data sent by the data processor through the data outbound business system, the consistency verification subsystem on the data processing side extracts the contents of each target field corresponding to the outbound data according to the extraction strategy of each target field in the outbound data policy file, and constructs the audit log and the statistical log; then the consistency verification subsystem on the verification and inspection side applies privacy computing technology according to the outbound verification rule file to perform consistency verification on the audit log and the statistical log.

2. A method for verifying consistency of data outbound transmission according to claim 1, characterized in that: The outbound data policy file jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side is obtained according to the following steps A1 to A3; Step A1. The data processing side consistency verification subsystem configures the outbound data policy file including the outbound data business scenario, target output location, extraction strategy of each target field, and preset mapping relationship of each target field with respect to important data category, sensitive personal information category, and non-sensitive personal information category, according to the outbound data to be sent by the data processor through the data outbound business system. The extraction strategy of each target field includes the preset extraction location, extraction range, and preset verification rule of each target field corresponding to the outbound data, and then proceeds to step A2; Step A2. The consistency verification subsystem on the data processing side sends the outbound data policy file to the consistency verification subsystem on the verification and inspection side, and the consistency verification subsystem on the verification and inspection side reviews the outbound data policy file. If the review is confirmed, the review confirmation result is fed back to the consistency verification subsystem on the data processing side, and the consistency verification subsystem on the data processing side signs the outbound data policy file through the digital certificate signature system; if the review is not confirmed, the unconfirmed content in the outbound data policy file is returned to the consistency verification subsystem on the data processing side, and the process goes to step A3; Step A3. The data processing side consistency verification subsystem reconfigures the unconfirmed contents in the outbound data policy file according to the outbound data to be sent by the data processor through the data outbound business system, updates the outbound data policy file, and then returns to step A2.

3. A method for verifying consistency of data outbound transmission according to claim 2, characterized in that: In the step A2, the consistency verification subsystem on the verification inspection side performs a review on the outbound data policy file according to the following steps A2-1 to A2-3; Rule A2-1. For each target field in the outbound data strategy file, determine whether the target field meets the target specification standard, and whether the target field matches its corresponding extraction range and preset verification rules. If both judgments are yes, proceed to step A2-2; if both judgments are no, the outbound data strategy file is not confirmed by the review, and the contents of the unconfirmed review are determined; Rule A2-2. According to the target fields in the outbound data policy file, determine whether the outbound data business scenario in the outbound data policy file is correct, if so, proceed to step A2-3; otherwise, the outbound data policy file is not confirmed, and determine the content of the unconfirmed review; Step A2-3. Determine whether the storage space of the target output location in the outbound data policy file is greater than the preset storage threshold space, and determine whether the security protection level corresponding to the target output location meets the preset security threshold level. If both judgments are yes, the outbound data policy file is reviewed and confirmed; if both judgments are no, the outbound data policy file is reviewed and not confirmed, and the content of the review and not confirmed is determined.

4. A method for verifying consistency of data outbound transmission according to claim 2, characterized in that: For outbound data sent by the data processor via the data outbound business system, the consistency verification subsystem on the data processing side extracts the contents of each target field corresponding to the outbound data according to the extraction strategies of each target field in the outbound data policy file, and verifies the contents of each extracted target field according to the preset verification rules in the extraction strategies of each target field, discards the contents that fail the verification, obtains the contents that pass the verification, and then constructs the audit log in combination with the outbound data business scenario, the domestic business system IP address corresponding to the outbound data, the overseas recipient IP address, and the data transmission time; Then, the consistency verification subsystem on the data processing side counts the total number of bytes of the content of each target field corresponding to the important data category, the sensitive personal information category, and the non-sensitive personal information category according to the mapping relationship between each target field preset in the outbound data policy file, and counts the total number of people involved in the content of each target field corresponding to the important data category after duplication and the total number of people involved in the content of each target field corresponding to the sensitive personal information category and the non-sensitive personal information category, and constructs the statistical log; Finally, the audit log and the statistical log are output to the target output location in the outbound data policy file.

5. A method for verifying consistency of data outbound transmission according to claim 4, characterized in that: The exit verification rule file corresponding to the exit data declaration materials uploaded by the data processor and jointly reviewed and confirmed by the consistency verification subsystem on the data processing side and the consistency verification subsystem on the verification and inspection side is obtained according to the following steps B1 to B3; Step B1. The consistency verification subsystem on the verification and inspection side configures the outbound verification rule file based on the outbound data declaration materials uploaded by the data processor, including the outbound data business scenario corresponding to the outbound data declaration materials, the content of each target field, the total number of bytes of the content of each target field corresponding to the important data category, the total number of people involved in the content of each target field corresponding to the sensitive personal information category and the non-sensitive personal information category after deduplication, as well as the corresponding domestic business system IP address, the overseas recipient IP address, and the data transmission time, and then proceeds to step B2; Step B2. The consistency verification subsystem on the verification and inspection side sends the exit verification rule file to the consistency verification subsystem on the data processing side, and the consistency verification subsystem on the data processing side verifies whether the exit verification rule file is consistent with the exit data declaration materials. If yes, it verifies and confirms, and feeds back the verification and confirmation result to the consistency verification subsystem on the verification and inspection side, and the consistency verification subsystem on the verification and inspection side signs the exit verification rule file through the digital certificate signature system; otherwise, if the verification is not confirmed, the contents in the exit verification rule file that have not been confirmed will be returned to the consistency verification subsystem on the verification and inspection side, and the process goes to step B3; Step B3. The consistency verification subsystem on the verification inspection side reconfigures the unconfirmed contents in the outbound verification rule file according to the outbound data declaration materials uploaded by the data processor, updates the outbound verification rule file, and then returns to step B2.

6. A method for verifying consistency of data outbound transmission according to claim 5, characterized in that: The consistency verification subsystem on the verification inspection side applies privacy computing technology according to the exit verification rule file to perform the following steps I to II to perform consistency verification on the audit log and the statistical log; Step I. The consistency verification subsystem on the verification inspection side compares the contents of each target field in each outbound data business scenario in the audit log with the contents of each target field in the corresponding outbound data business scenario in the outbound verification rule file based on the privacy intersection algorithm, and gives a conclusion on whether the contents of each target field in the audit log exceed the outbound data declaration materials, with a mark of 1 for exceeding and a mark of 0 for not exceeding; The consistency verification subsystem on the verification inspection side compares the data outbound communication link formed by the IP address of the domestic business system and the IP address of the overseas recipient in each outbound data business scenario in the audit log based on the privacy intersection algorithm according to the outbound verification rule file, and the data outbound communication link in the corresponding outbound data business scenario in the outbound verification rule file, and gives a conclusion on whether the data outbound communication link in the audit log exceeds the outbound data declaration materials, and marks it as 1 if it exceeds, and 0 if it does not exceed; The consistency verification subsystem on the verification inspection side determines, according to the outbound verification rule file and based on the privacy computing comparison algorithm, whether the total number of bytes of the content of each target field corresponding to the important data category in each outbound data business scenario in the statistical log exceeds the total number of bytes of the content of each target field corresponding to the important data category in the corresponding outbound data business scenario in the outbound verification rule file. If yes, it is exceeded and marked as 1; otherwise, it is not exceeded and marked as 0; The consistency verification subsystem on the verification inspection side determines, based on the comparison algorithm of privacy computing and the outbound verification rule file, whether the total number of people after deduplication involved in the target field contents of the sensitive personal information category and the non-sensitive personal information category in each outbound data business scenario in the statistical log exceeds the total number of people after deduplication involved in the target field contents of the sensitive personal information category and the non-sensitive personal information category in the corresponding outbound data business scenario in the outbound verification rule file; if so, it exceeds and is marked as 1; otherwise, it does not exceed and is marked as 0; Then proceed to step II; Step II. The consistency verification subsystem on the verification inspection side performs weighted processing on the tag value of each comparison result according to the preset weights corresponding to each comparison in step I, and obtains the exit violation risk value corresponding to the audit log and the statistical log.

7. A method for verifying consistency of data outbound transmission according to claim 2, characterized in that: It also includes applying blockchain technology to the outbound data policy file, the outbound verification rule file, and the outbound violation risk values ​​corresponding to the audit log and the statistical log, and performing on-chain evidence storage.

8. A system for implementing the method for verifying the consistency of data outbound transmission as claimed in claim 5 or 6, characterized in that: It includes the data processing side consistency verification subsystem, the verification and inspection side consistency verification subsystem, and the data outbound business system. The data processing side consistency verification subsystem includes an outbound data log extraction module and a privacy computing node. The verification and inspection side consistency verification subsystem includes a data outbound verification rule configuration module and a privacy computing node. The outbound data log extraction module in the consistency verification subsystem on the data processing side is used to execute steps A1 and A3 to configure the outbound data policy file, execute the review of the outbound verification rule file in step B2, execute step A2 to sign the outbound data policy file through a digital certificate signature system, and extract the content of each target field corresponding to the outbound data according to the extraction strategy of each target field in the outbound data policy file, and construct the audit log and the statistical log; The privacy computing node in the consistency verification subsystem on the data processing side is used as the target output location in the outbound data policy file to receive the audit log and the statistical log; The data outbound verification rule configuration module in the consistency verification subsystem on the verification inspection side is used to execute steps B1 and B3 to configure the outbound verification rule file, execute the review of the outbound data policy file in step A2, and execute step B2 to sign the outbound verification rule file through a digital certificate signature system; The privacy computing node in the consistency verification subsystem on the verification inspection side is used to receive the signed outbound verification rule file; The data outbound business system is used to provide outbound data sending services to data processors; The consistency verification subsystem on the verification inspection side applies privacy computing technology according to the outbound verification rule file in its privacy computing node to perform consistency verification on the audit log and the statistical log in the privacy computing node of the consistency verification subsystem on the data processing side.

9. A system for verifying the consistency of data outbound transmission according to claim 8, characterized in that: It also includes a blockchain system, and the data processing side consistency verification subsystem and the verification and inspection side consistency verification subsystem also include a blockchain evidence storage module, wherein the blockchain evidence storage module in the data processing side consistency verification subsystem is used to receive the outbound data policy file from the outbound data log extraction module, the audit log from the corresponding privacy computing node, and the outbound violation risk value corresponding to the statistical log, and forward it to the blockchain system to execute on-chain evidence storage; The blockchain evidence module in the consistency verification subsystem on the verification inspection side is used to receive the outbound verification rule file from the data outbound verification rule configuration module, the audit log from the corresponding privacy computing node, and the outbound violation risk value corresponding to the statistical log, and forward it to the blockchain system to execute on-chain evidence storage.

Images