Port sensitive information protection method based on data desensitization

Abstract

The invention provides a port sensitive information protection method based on data desensitization, and belongs to the field of data security and privacy protection, and the method comprises the steps: 1, regularly collecting original data from each data source of a port operation system, and employing a natural language processing technology and a regular expression to recognize the sensitive information of the original data, and obtaining a sensitive information set; 2, a visual user interface is developed, a user is supported to dynamically adjust desensitization rules according to port business requirements, and the desensitization rules are stored in a rule base in a key-value pair mode; 3, generating and executing a desensitization strategy according to the type of the sensitive information and the business requirement in combination with the desensitization rule; 4, on the basis of a verification function, verifying whether the desensitized data after desensitization contains sensitive information, and confirming whether the desensitized data meets service logic requirements or not; and step 5, sharing the data to an authorized user by adopting a safe data transmission protocol. Sensitive data are effectively protected, dynamic desensitization is supported, and it is ensured that data safety is consistent with service requirements.

Description

Technical Field

[0001] The present invention relates to the field of data security and privacy protection, and in particular to a method for protecting sensitive port information based on data desensitization. Background Art

[0002] As port operations are deeply integrated into the wave of digitalization, a large amount of sensitive information is gathered in the port operation system. Once this information is leaked, it will cause serious business crises and privacy infringement issues. At present, data encryption and access control are commonly used data protection methods. Data encryption performs well in protecting data privacy, but in the data analysis stage, decryption operations will expose data to risks; although access control can limit illegal external access, it is difficult to prevent malicious operations by internal personnel.

[0003] As an emerging method, data desensitization technology processes sensitive information through replacement, blurring, etc. to preserve data availability. However, when applied in the port industry, the existing desensitization technology exposes many problems: first, the ability to identify unique sensitive information in port business scenarios is seriously insufficient, and it is impossible to accurately locate and process key data; second, the desensitized data is often disconnected from the business logic, resulting in deviations in data analysis results; third, there is a lack of a mechanism for dynamically evaluating and adjusting the desensitization effect, making it difficult to adapt to complex and changing business needs. It is urgent to develop a data desensitization system adapted to the port industry.

[0004] Therefore, the present invention proposes a port sensitive information protection method based on data desensitization. Summary of the invention

[0005] The present invention provides a port sensitive information protection method based on data desensitization, which is used to protect various types of sensitive information generated and processed in port operations, covering key data such as customer information, cargo value, and transportation routes, to ensure that the data after the desensitization operation can be safely used for data analysis and sharing under the premise of meeting business logic, thereby effectively promoting the safe development of port digital operations.

[0006] On the one hand, the present invention provides a method for protecting sensitive port information based on data desensitization, comprising: Step 1: Regularly collect raw data from various data sources of the port operation system, use natural language processing technology and regular expressions to identify sensitive information in the raw data, and obtain a sensitive information set; Step 2: Develop a visual user interface to support users to dynamically adjust desensitization rules according to port business needs. The desensitization rules are stored in the rule base in the form of key-value pairs; Step 3: Generate and execute a desensitization strategy based on the type of sensitive information and business requirements and combined with desensitization rules; Step 4: Based on the verification function, verify whether the desensitized data contains sensitive information, and confirm whether the desensitized data meets the business logic requirements; Step 5: Use secure data transmission protocols to share the desensitized data with authorized users.

[0007] On the other hand, raw data is regularly collected from various data sources of the port operation system, including: According to the target data source of the port operation system, obtain the connection information of all target data sources; Based on the sensitive information identification module, the original data of the target data source is collected at a preset regular time by utilizing the data interface and the connection information of any target data source.

[0008] On the other hand, natural language processing technology and regular expressions are used to identify sensitive information in the original data, and a sensitive information set is obtained, including: Acquire original data from any target data source, and perform text cleaning on the original data to obtain a first text; Based on the sensitive information identification module, each byte code in the first text is converted into a word vector to obtain a second text, and the second text is propagated forward and backward based on the bidirectional long short-term memory network to obtain text features from two directions respectively. The probability of any word segmentation label appearing in the first text is predicted by combining the text features: ;in, represents the probability of occurrence of the i-th word segmentation label in the first text, n represents that there are n word segmentation labels in the first text sequence, W represents the first text sequence, Represents the internal probability of the word segmentation tag, ( ) represents the exponential function, Represents the characteristic function of the i-th text feature, represents the transfer feature function between the i-th text feature and the i-1-th text feature, represents the normalization factor of the first text sequence; If the occurrence probability of any word segmentation label is greater than the preset first text sequence probability, the word segmentation label is determined to be a key word segmentation, and the key word segmentation sequence of the original data is obtained; Design a regular expression based on any preset sensitive word, input the key word sequence, and perform character matching based on the indicator function: ; Where D represents the key word sequence, represents the i-th key word, ( ) indicates an indicator function, which is generated by a regular expression. Represents a collection of sensitive information; If all characters of any key word satisfy the indicator function, the key word is returned and marked as sensitive information, and the key word is included in the sensitive information set. , and add a tag to the sensitive information, where the tag includes the type and location of the sensitive information.

[0009] On the other hand, a visual user interface is developed to support users to dynamically adjust desensitization rules according to port business needs. The desensitization rules are stored in the rule base in the form of key-value pairs, including: The desensitization rule management module develops and designs a visual user desensitization rule interface based on system and user requirements. The desensitization rule management module provides flexible rule configuration and management functions, supporting users to dynamically adjust desensitization rules according to port business requirements; The user selects the sensitive information type and the corresponding desensitization method on the user desensitization rule interface. Customization is supported to generate desensitization rules for sensitive information type and desensitization method. Create a rule base based on the preset field type, and store the configured desensitization rules in the rule base in the form of key-value pairs, where the key is the sensitive information type and the value is the desensitization method and related parameters; When business needs change, modify the rules through the user desensitization rule interface and update the data in the rule base in real time.

[0010] On the other hand, based on the type of sensitive information and business requirements, desensitization policies are generated and executed in combination with desensitization rules, including: Obtain the type and business requirements of any sensitive information in the sensitive information set, and obtain the desensitization rules of the sensitive information in combination with the rule base; If the desensitization rule of the sensitive information is a replacement type, a replacement dictionary is constructed, and the replacement information after the sensitive information is replaced is: ;in, Indicates replacement information. represents the jth string of the sensitive information, k represents that there are k strings of sensitive information in total, represents the desensitization rule function, Indicates the sensitive information; If the desensitization rule of the sensitive information is encryption type, the sensitive information is encrypted based on the industry standard AES algorithm: Generate an initial key, group the sensitive information to obtain a plaintext data block of a predetermined data length; perform AES encryption on the first plaintext block based on the initial key to obtain a first ciphertext block, perform XOR processing on the second plaintext block and the first ciphertext block, then perform AES encryption based on the initial key to obtain a second ciphertext block, iteratively process all plaintext data blocks to obtain a final ciphertext block, and the encrypted information is generated by combining the final ciphertext blocks.

[0011] On the other hand, it also includes: If the desensitization rule of the sensitive information is of fuzzy type, the sensitive information is fuzzified, which can be expressed as: ;in, represents the fuzzy interval after the fuzzification operation of the sensitive information, Indicates the sensitive information, Indicates the preset desensitization rule interval. represents the right end value of the fuzzy interval, represents the left end value of the fuzzy interval, ( ) represents the fuzzy function, Indicates preset noise; Generate corresponding desensitization strategies according to different sensitive information, and process them one by one based on the desensitization processing module to obtain the desensitized information corresponding to any sensitive information.

[0012] On the other hand, based on the verification function, verify whether the desensitized data contains sensitive information and confirm whether the desensitized data meets the business logic requirements, including: Construct verification functions and corresponding weight coefficients based on historical data and business logic requirements; Get any desensitized data, and get the sensitive information corresponding to the desensitized data, and get the matching degree between the desensitized data and the sensitive information based on the verification function: ;in, Indicates the matching degree between the desensitized data and the sensitive information. represents the distance metric weight coefficient, Indicates the pth character value of the desensitized data, represents the qth character value of the sensitive information, represents the recovery probability weight coefficient, Indicates the preset compression ratio coefficient. represents the average uncertainty of the desensitized data, ( ) represents the occurrence probability of the pth character value of the desensitized data, The weight coefficient indicating that the desensitized data contains sensitive information, Indicates the function for determining sensitive information. Indicates the desensitized data. If the desensitized data has sensitive features, the matching degree is determined to be the maximum abnormal value; If the matching degree is greater than the preset sensitivity threshold, it is determined that the desensitization effect does not meet the standard and does not meet the business logic requirements. Otherwise, the desensitization effect meets the standard.

[0013] On the other hand, secure data transmission protocols are used to share desensitized data with authorized users, including: The data analysis and sharing module uses a secure data transmission protocol to share desensitized data with authorized users; During the sharing process, the desensitized data is digitally signed and encrypted, and the data analysis sharing module has a built-in data analysis engine to perform data analysis operations on the desensitized data and generate data forecasts and statistical reports; An audit log system is established in the data analysis and sharing module to record detailed information on the sharing and analysis of desensitized data. The use of desensitized data is monitored in real time through the monitoring system. If any abnormal operation is found, an alarm will be issued in a timely manner.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a port sensitive information protection method based on data desensitization, which is used to protect various types of sensitive information generated and processed in port operations, covering key data such as customer information, cargo value, and transportation routes, to ensure that the data after the desensitization operation can be safely used for data analysis and sharing under the premise of meeting business logic, thereby effectively promoting the safe development of port digital operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flow chart of a method for protecting sensitive port information based on data desensitization provided by an embodiment of the present invention; Figure 2 The embodiment of the present invention provides a desensitization rule table; Figure 3 It is a framework diagram of the data desensitization system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Embodiment 1: like Figure 1 As shown, the method for protecting sensitive port information based on data desensitization provided by an embodiment of the present invention includes: Step 1: Regularly collect raw data from various data sources of the port operation system, use natural language processing technology and regular expressions to identify sensitive information in the raw data, and obtain a sensitive information set; Step 2: Develop a visual user interface to support users to dynamically adjust desensitization rules according to port business needs. The desensitization rules are stored in the rule base in the form of key-value pairs; Step 3: Generate and execute a desensitization strategy based on the type of sensitive information and business requirements and combined with desensitization rules; Step 4: Based on the verification function, verify whether the desensitized data contains sensitive information, and confirm whether the desensitized data meets the business logic requirements; Step 5: Use secure data transmission protocols to share the desensitized data with authorized users.

[0019] In this embodiment, the port operation system is a comprehensive information system for managing and optimizing the daily operation activities of the port.

[0020] In this embodiment, the data source refers to an object that provides raw data, such as a customer management database, a cargo transportation record system, and the like.

[0021] In this embodiment, the raw data refers to the original information directly collected from the port operation system without being processed, desensitized or modified.

[0022] In this embodiment, natural language processing technology is a technology in the field of artificial intelligence (AI) that enables computers to understand, process and generate natural languages ​​(such as Chinese, English, etc.). Its core goal is to enable computers to interact with humans in natural languages ​​and extract useful information from them.

[0023] In this embodiment, a regular expression is a tool for describing and matching string patterns, and a set of special characters is used to define the matching rules of text strings, thereby facilitating operations such as text search, replacement, verification and extraction.

[0024] In this embodiment, sensitive information refers to any private, confidential or protected information that can identify or be associated with an individual, organization or system, such as ID number, name, address, bank card number, corporate customer list, etc.

[0025] In this embodiment, the sensitive information set refers to a set of all sensitive data identified from the port operation system through natural language processing technology and regular expressions.

[0026] In this embodiment, the user interface is a visual tool for users to interact with the system and adjust the desensitization rules according to port business requirements.

[0027] In this embodiment, port business needs refer to various functions required to ensure data security, improve efficiency and meet legal compliance requirements during port operations, including: data security and privacy protection, business process optimization, compliance and auditing, etc.

[0028] In this embodiment, the desensitization rules refer to specific operations and standards for processing sensitive information, which define how to identify and transform sensitive information in raw data.

[0029] In this embodiment, a key-value pair is a data storage method used to represent a pair of related elements, where a "key" is a unique identifier used to access and reference data, and a "value" is the data content associated with the key.

[0030] In this embodiment, the rule base is a database that stores desensitization rules, such as Figure 2 shown.

[0031] In this embodiment, the types include: customer information, cargo information, transportation records and other types.

[0032] In this embodiment, the desensitization strategy refers to a series of data processing rules adopted to ensure privacy and security when processing sensitive information, for example: replacing part of the ID number with the "*" symbol and retaining part of the information for verification.

[0033] In this embodiment, the verification function is a function used to check whether the desensitized data meets the expected logical requirements and ensure that the sensitive information has been effectively processed. Its main function is to verify the data after the desensitization operation to ensure that the desensitized data does not leak sensitive information, and also to ensure that the desensitized data still meets the needs of the business scenario.

[0034] In this embodiment, desensitizing data refers to processing sensitive information contained in the original data so that it cannot be accessed or restored by unauthorized personnel, while retaining some validity and availability of the data.

[0035] In this embodiment, the business logic requirements include: data integrity, rule consistency, data availability, etc.

[0036] In this embodiment, the data transmission protocol refers to a communication protocol used to protect data from being accessed, modified or tampered with by unauthorized personnel during transmission, such as HTTP, TLS, VPN, etc.

[0037] In this embodiment, the authorized user refers to an object that has the authority to access the desensitized data, such as an internal department or an external partner.

[0038] In this embodiment, the port sensitive information protection method based on data desensitization is implemented based on the data desensitization system, such as Figure 3 shown.

[0039] The working principle and beneficial effects of the above technical solution are: through automated sensitive information identification, dynamic rule management, desensitization strategy generation and execution, data verification and secure transmission, it ensures that sensitive information in the port operation system is protected, while ensuring the effectiveness and security of data in business analysis.

[0040] Embodiment 2: Based on the above embodiment 1, raw data is regularly collected from various data sources of the port operation system, including: According to the target data source of the port operation system, obtain the connection information of all target data sources; Based on the sensitive information identification module, the original data of the target data source is collected at a preset regular time by utilizing the data interface and the connection information of any target data source.

[0041] In this embodiment, the connection information refers to all necessary information for establishing communication with the target data source, such as the address, port number, authentication information, etc. of the data source.

[0042] In this embodiment, the sensitive information identification module is a system component specifically used to identify and classify sensitive information in data.

[0043] In this embodiment, the data interface refers to a standardized channel for connecting, exchanging and transmitting data.

[0044] In this embodiment, the preset regular time The working principle and beneficial effects of the above technical solution are: by obtaining the connection information of the target data source, regularly collecting raw data and combining it with the sensitive information identification module, it ensures real-time acquisition and processing of data, effectively identifies and protects sensitive information, and improves the efficiency and security of system data collection.

[0045] Embodiment 3: Based on the above-mentioned embodiment 2, natural language processing technology and regular expressions are used to identify sensitive information of the original data to obtain a sensitive information set, including: Acquire original data from any target data source, and perform text cleaning on the original data to obtain a first text; Based on the sensitive information identification module, each byte code in the first text is converted into a word vector to obtain a second text, and the second text is propagated forward and backward based on the bidirectional long short-term memory network to obtain text features from two directions respectively. The probability of any word segmentation label appearing in the first text is predicted by combining the text features: ;in, represents the probability of occurrence of the i-th word segmentation label in the first text, n represents that there are n word segmentation labels in the first text sequence, W represents the first text sequence, represents the internal probability of the word segmentation tag, ( ) represents the exponential function, Represents the characteristic function of the i-th text feature, represents the transfer feature function between the i-th text feature and the i-1-th text feature, represents the normalization factor of the first text sequence; If the occurrence probability of any word segmentation label is greater than the preset first text sequence probability, the word segmentation label is determined to be a key word segmentation, and the key word segmentation sequence of the original data is obtained; Design a regular expression based on any preset sensitive word, input the key word sequence, and perform character matching based on the indicator function: ; Where D represents the key word sequence, represents the i-th key word, ( ) indicates an indicator function, which is generated by a regular expression. Represents a collection of sensitive information; If all characters of any key word satisfy the indicator function, the key word is returned and marked as sensitive information, and the key word is included in the sensitive information set. , and add a tag to the sensitive information, where the tag includes the type and location of the sensitive information.

[0046] In this embodiment, text cleaning is used to process and correct the original text data so as to extract useful information and remove irrelevant or messy data.

[0047] In this embodiment, the first text refers to the original data text after preliminary text cleaning processing.

[0048] In this embodiment, byte encoding is the process of converting character data into a binary format that can be understood by a computer.

[0049] In this embodiment, word vector refers to mapping each word into a multi-dimensional vector.

[0050] In this embodiment, the second text is a text obtained by converting the byte encoding in the first text into a word vector.

[0051] In this embodiment, the bidirectional long short-term memory network is an improved recurrent neural network (RNN) that can simultaneously capture information in forward (from front to back) and reverse (from back to front) sequences when processing sequence data.

[0052] In this embodiment, propagation refers to the process of forward propagation and backward propagation of information through the network.

[0053] In this embodiment, the text feature is a feature vector obtained from two directions after forward propagation and back propagation calculation.

[0054] In this embodiment, the word segmentation label refers to a label assigned to each word segment (ie, each word or subword in the text) when the text is segmented.

[0055] In this embodiment, the transfer feature function represents the feature when transferring from one label to another label. In the sequence labeling task, it is mainly used to model the probability of a label being transferred given the context (i.e., the previous and next labels).

[0056] In this embodiment, the normalization factor is used to standardize the results predicted by the model so that the sum of the probabilities of each word segmentation label in the entire text sequence is equal to 1, thereby meeting the basic requirements of probability distribution.

[0057] In this embodiment, the preset first text sequence probability is a threshold value used for comparison and judgment of whether a word segmentation label is a key word segmentation.

[0058] In this embodiment, key words refer to words that are considered to be specific important information in text processing.

[0059] In this embodiment, the preset sensitive words refer to a predefined set of words or phrases, including sensitive content that requires special attention.

[0060] In this embodiment, character matching refers to searching for characters, words or phrases that match a given text sequence according to a specific rule pattern.

[0061] The working principle and beneficial effects of the above technical solution are: extracting text features through text cleaning, word vector conversion and bidirectional long short-term memory network, combining probability prediction to identify key word segmentations, and using regular expressions to match sensitive information, ensuring efficient and accurate identification and marking of sensitive information, and improving data security and accuracy.

[0062] Embodiment 4: Based on the above embodiment 1, a visual user interface is developed to support users to dynamically adjust the desensitization rules according to port business needs. The desensitization rules are stored in the rule base in the form of key-value pairs, including: The desensitization rule management module develops and designs a visual user desensitization rule interface based on system and user requirements. The desensitization rule management module provides flexible rule configuration and management functions, supporting users to dynamically adjust desensitization rules according to port business requirements; The user selects the sensitive information type and the corresponding desensitization method on the user desensitization rule interface. Customization is supported to generate desensitization rules for sensitive information type and desensitization method. Create a rule base based on the preset field type, and store the configured desensitization rules in the rule base in the form of key-value pairs, where the key is the sensitive information type and the value is the desensitization method and related parameters; When business needs change, modify the rules through the user desensitization rule interface and update the data in the rule base in real time.

[0063] In this embodiment, the desensitization rule management module is a system component for managing and configuring sensitive information desensitization rules.

[0064] In this embodiment, the user desensitization rule interface is a visual operation interface that aims to provide users with a convenient way to configure, manage and adjust data desensitization rules.

[0065] In this embodiment, rule configuration refers to the process of configuring, managing and adjusting the desensitization rules in the desensitization rule management module through the user desensitization rule interface according to business needs and system requirements.

[0066] In this embodiment, the preset field type refers to a field type that is pre-defined by the system for common sensitive data types in order to facilitate the configuration and application of desensitization rules in the desensitization rule management system.

[0067] The working principle and beneficial effects of the above technical solution are: through a visual interface and flexible rule configuration, it supports users to dynamically adjust desensitization rules according to needs, and stores the rules in a rule library to ensure that the desensitization strategy is updated in real time, thereby improving the flexibility and adaptability of data protection.

[0068] Embodiment 5: Based on the above embodiment 1, a desensitization strategy is generated and executed in combination with desensitization rules according to the type of sensitive information and business requirements, including: Obtain the type and business requirements of any sensitive information in the sensitive information set, and obtain the desensitization rules of the sensitive information in combination with the rule base; If the desensitization rule of the sensitive information is a replacement type, a replacement dictionary is constructed, and the replacement information after the sensitive information is replaced is: ;in, Indicates replacement information. represents the jth string of the sensitive information, k represents that there are k strings of sensitive information in total, represents the desensitization rule function, Indicates the sensitive information; If the desensitization rule of the sensitive information is encryption type, the sensitive information is encrypted based on the industry standard AES algorithm: Generate an initial key, group the sensitive information to obtain a plaintext data block of a predetermined data length; perform AES encryption on the first plaintext block based on the initial key to obtain a first ciphertext block, perform XOR processing on the second plaintext block and the first ciphertext block, then perform AES encryption based on the initial key to obtain a second ciphertext block, iteratively process all plaintext data blocks to obtain a final ciphertext block, and the encrypted information is generated by combining the final ciphertext blocks.

[0069] In this embodiment, the replacement dictionary refers to a data structure used to store sensitive information replacement rules.

[0070] In this embodiment, the replacement information refers to the information obtained after the sensitive information is replaced.

[0071] In this embodiment, the AES algorithm is an algorithm for encrypting data blocks, and the size of each data block is fixed to 128 bits (ie, 16 bytes).

[0072] In this embodiment, the initial key refers to a key generated before the AES encryption algorithm starts and is used to encrypt sensitive information.

[0073] In this embodiment, the predetermined data length refers to the data block length required when the AES encryption algorithm processes plaintext data.

[0074] In this embodiment, the plaintext data block refers to the data segments of predetermined data length into which the information is divided during the encryption process.

[0075] In this embodiment, the XOR process is a binary operation for performing a logical XOR operation on two bits.

[0076] In this embodiment, the final ciphertext block refers to the last encrypted data block obtained by iteratively encrypting all plaintext data blocks after the sensitive information is encrypted using the AES encryption algorithm.

[0077] The working principle and beneficial effects of the above technical solution are: by combining the rule base and business needs, using replacement or encryption desensitization methods for sensitive information, using the AES algorithm for encryption processing, ensuring the security and confidentiality of sensitive information, and effectively realizing dynamic and accurate desensitization operations.

[0078] Embodiment 6: Based on the above embodiment 5, it also includes: If the desensitization rule of the sensitive information is of fuzzy type, the sensitive information is fuzzified, which can be expressed as: ;in, represents the fuzzy interval after the fuzzification operation of the sensitive information, Indicates the sensitive information, Indicates the preset desensitization rule interval. represents the right end value of the fuzzy interval, represents the left end value of the fuzzy interval, ( ) represents the fuzzy function, Indicates preset noise; Generate corresponding desensitization strategies according to different sensitive information, and process them one by one based on the desensitization processing module to obtain the desensitized information corresponding to any sensitive information.

[0079] In this embodiment, the fuzzification operation converts the original data into a "fuzzy" range or interval, thereby avoiding the exposure of precise sensitive information while still maintaining the availability of the data, which is suitable for data analysis or processing needs.

[0080] In this embodiment, the fuzzy interval represents an interval range formed after the original sensitive information is fuzzified.

[0081] In this embodiment, the fuzzy function is a mathematical method for generating a fuzzy interval.

[0082] In this embodiment, the preset noise refers to increasing the unpredictability of data processing by adding random or uncertain factors during the desensitization process, thereby better protecting the original sensitive information.

[0083] The working principle and beneficial effects of the above technical solution are: desensitizing sensitive information through fuzzification operations, generating corresponding desensitization strategies, and processing them one by one through the desensitization processing module to ensure the privacy protection of sensitive information, while providing flexible desensitization methods to enhance data security.

[0084] Embodiment 7: On the basis of the above-mentioned embodiment 1, based on the verification function, verify whether the desensitized data contains sensitive information, and confirm whether the desensitized data meets the business logic requirements, including: Construct verification functions and corresponding weight coefficients based on historical data and business logic requirements; Get any desensitized data, and get the sensitive information corresponding to the desensitized data, and get the matching degree between the desensitized data and the sensitive information based on the verification function: ;in, Indicates the matching degree between the desensitized data and the sensitive information. represents the distance metric weight coefficient, Indicates the pth character value of the desensitized data, represents the qth character value of the sensitive information, represents the recovery probability weight coefficient, Indicates the preset compression ratio coefficient. represents the average uncertainty of the desensitized data, ( ) represents the occurrence probability of the pth character value of the desensitized data, The weight coefficient indicating that the desensitized data contains sensitive information, Indicates the function for determining sensitive information. Indicates the desensitized data. If the desensitized data has sensitive features, the matching degree is determined to be the maximum abnormal value; If the matching degree is greater than the preset sensitivity threshold, it is determined that the desensitization effect does not meet the standard and does not meet the business logic requirements. Otherwise, the desensitization effect meets the standard.

[0085] In this embodiment, historical data refers to relevant data sets collected from actual businesses or events in the past.

[0086] In this embodiment, the matching degree is a metric for measuring the similarity between the desensitized data and the sensitive information.

[0087] In this embodiment, the distance measurement weight coefficient is a parameter used to measure the similarity between the desensitized data and the sensitive information.

[0088] In this embodiment, the recovery probability weight coefficient is a parameter that measures the possibility of restoring the desensitized data to the original sensitive information.

[0089] In this embodiment, the preset compression ratio coefficient is a parameter of the compression ratio between the desensitized data and the original sensitive data, which is used to measure the degree of data compression.

[0090] In this embodiment, the preset sensitivity threshold refers to a standard value used to evaluate the matching degree between desensitized data and sensitive information.

[0091] The working principle and beneficial effects of the above technical solution are: by constructing verification functions and weight coefficients, the matching degree between desensitized data and sensitive information is evaluated to ensure that the desensitization effect meets the business logic requirements. By analyzing the matching degree, it is possible to determine in real time whether the desensitization effect meets the requirements, effectively improving the accuracy and reliability of data privacy protection.

[0092] Embodiment 8: Based on the above embodiment 1, a secure data transmission protocol is used to share the desensitized data with authorized users, including: The data analysis and sharing module uses a secure data transmission protocol to share desensitized data with authorized users; During the sharing process, the desensitized data is digitally signed and encrypted, and the data analysis sharing module has a built-in data analysis engine to perform data analysis operations on the desensitized data and generate data forecasts and statistical reports; An audit log system is established in the data analysis and sharing module to record detailed information on the sharing and analysis of desensitized data. The use of desensitized data is monitored in real time through the monitoring system. If any abnormal operation is found, an alarm will be issued in a timely manner.

[0093] In this embodiment, digital signature is an encryption technology used to ensure data integrity, identity authentication and prevent tampering, which is implemented by public key encryption and private key decryption. In the process of data transmission, storage or sharing, digital signature can provide effective security protection to ensure that the data source is reliable and the content has not been tampered with.

[0094] In this embodiment, the functions of the data analysis engine cover various aspects such as data processing, calculation, modeling and prediction, and is the core part of the data analysis system.

[0095] In this embodiment, the data analysis operation supports statistical analysis, trend prediction and other operations on the desensitized data. For example, the statistical analysis function is used to calculate indicators such as cargo throughput and customer business volume; and the machine learning algorithm is used to predict the trend of future cargo flow in the port.

[0096] In this embodiment, data forecasting and statistical reporting are important results generated during the data analysis process, helping users understand data trends, make future decisions, and extract key information from the analysis.

[0097] In this embodiment, the audit log system is a tool for recording and tracking operations and events within the system, aiming to improve data security, ensure compliance and facilitate post-audit.

[0098] In this embodiment, detailed information includes user information, data access logs, data analysis operations, etc. In this embodiment, abnormal operations include: unauthorized access, abnormal access frequency, abnormal data request, data modification and other operations.

[0099] The working principle and beneficial effects of the above technical solution are: ensuring the security of desensitized data sharing through secure transmission protocols, digital signatures and encryption, while using the data analysis engine to generate reports and establish audit logs and monitoring systems to ensure the compliant use of data and timely response to abnormal operations, thereby improving the security and transparency of data sharing.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for protecting sensitive port information based on data desensitization, characterized in that: include: Step 1: Regularly collect raw data from various data sources of the port operation system, use natural language processing technology and regular expressions to identify sensitive information in the raw data, and obtain a sensitive information set; Step 2: Develop a visual user interface to support users to dynamically adjust desensitization rules according to port business needs. The desensitization rules are stored in the rule base in the form of key-value pairs; Step 3: Generate and execute a desensitization strategy based on the type of sensitive information and business requirements and combined with desensitization rules; Step 4: Based on the verification function, verify whether the desensitized data contains sensitive information, and confirm whether the desensitized data meets the business logic requirements; Step 5: Use secure data transmission protocols to share the desensitized data with authorized users.

2. The method for protecting sensitive port information based on data desensitization according to claim 1 is characterized in that: Raw data is collected regularly from various data sources in the port operation system, including: According to the target data source of the port operation system, obtain the connection information of all target data sources; Based on the sensitive information identification module, the original data of the target data source is collected at a preset regular time by utilizing the data interface and the connection information of any target data source.

3. The method for protecting sensitive port information based on data desensitization according to claim 2 is characterized in that: Use natural language processing technology and regular expressions to identify sensitive information in raw data and obtain a sensitive information set, including: Acquire original data from any target data source, and perform text cleaning on the original data to obtain a first text; Based on the sensitive information identification module, each byte code in the first text is converted into a word vector to obtain a second text, and the second text is propagated forward and backward based on the bidirectional long short-term memory network to obtain text features from two directions respectively. The probability of any word segmentation label appearing in the first text is predicted by combining the text features: ;in, represents the probability of occurrence of the i-th word segmentation label in the first text, n represents that there are n word segmentation labels in the first text sequence, W represents the first text sequence, Represents the internal probability of the word segmentation tag, ( ) represents the exponential function, Represents the characteristic function of the i-th text feature, represents the transfer feature function between the i-th text feature and the i-1-th text feature, represents the normalization factor of the first text sequence; If the occurrence probability of any word segmentation label is greater than the preset first text sequence probability, the word segmentation corresponding to the word segmentation label is determined to be a key word segmentation, and the key word segmentation sequence of the original data is obtained; Design a regular expression based on any preset sensitive word, input the key word sequence, and perform character matching based on the indicator function: ; Where D represents the key word sequence, represents the i-th key word, ( ) indicates an indicator function, which is generated by a regular expression. Represents a collection of sensitive information; If all characters of any key word satisfy the indicator function, the key word is returned and marked as sensitive information, and the key word is included in the sensitive information set. , and add a tag to the sensitive information, where the tag includes the type and location of the sensitive information.

4. The method for protecting sensitive port information based on data desensitization according to claim 1 is characterized in that: Develop a visual user interface to support users to dynamically adjust desensitization rules according to port business needs, including: Develop and design a visual user desensitization rule interface based on system and user requirements; Provides flexible rule configuration and management functions, supporting users to dynamically adjust desensitization rules according to port business needs; The user selects the sensitive information type and the corresponding desensitization method on the user desensitization rule interface. Customization is supported to generate desensitization rules for sensitive information type and desensitization method. Create a rule base based on the preset field type, and store the configured desensitization rules in the rule base in the form of key-value pairs, where the key is the sensitive information type and the value is the desensitization method and related parameters; When business needs change, modify the rules through the user desensitization rule interface and update the data in the rule base in real time.

5. The method for protecting sensitive port information based on data desensitization according to claim 1 is characterized in that: Based on the type of sensitive information and business requirements, generate and execute desensitization strategies in combination with desensitization rules, including: Obtain the type and business requirements of any sensitive information in the sensitive information set, and obtain the desensitization rules of the sensitive information in combination with the rule base; If the desensitization rule of the sensitive information is a replacement type, a replacement dictionary is constructed, and the replacement information after the sensitive information is replaced is: ;in, Indicates replacement information. represents the jth string of the sensitive information, k represents that there are k strings of sensitive information in total, represents the desensitization rule function, Indicates the sensitive information; If the desensitization rule of the sensitive information is encryption type, the sensitive information is encrypted based on the industry standard AES algorithm: Generate an initial key, group the sensitive information to obtain a plaintext data block of a predetermined data length; perform AES encryption on the first plaintext block based on the initial key to obtain a first ciphertext block, perform XOR processing on the second plaintext block and the first ciphertext block, then perform AES encryption based on the initial key to obtain a second ciphertext block, iteratively process all plaintext data blocks to obtain a final ciphertext block, and the encrypted information is generated by combining the final ciphertext blocks.

6. The method for protecting sensitive port information based on data desensitization according to claim 5 is characterized in that: Also includes: If the desensitization rule of the sensitive information is of fuzzy type, the sensitive information is fuzzified, which can be expressed as: ;in, represents the fuzzy interval after the fuzzification operation of the sensitive information, Indicates the sensitive information, Indicates the preset desensitization rule interval. represents the right end value of the fuzzy interval, represents the left end value of the fuzzy interval, ( ) represents the fuzzy function, Indicates preset noise; Generate corresponding desensitization strategies according to different sensitive information, and process them one by one based on the desensitization processing module to obtain the desensitized information corresponding to any sensitive information.

7. The method for protecting sensitive port information based on data desensitization according to claim 1 is characterized in that: Based on the verification function, verify whether the desensitized data contains sensitive information and confirm whether the desensitized data meets the business logic requirements, including: Construct verification functions and corresponding weight coefficients based on historical data and business logic requirements; Get any desensitized data, and get the sensitive information corresponding to the desensitized data, and get the matching degree between the desensitized data and the sensitive information based on the verification function: ;in, Indicates the matching degree between the desensitized data and the sensitive information. represents the distance metric weight coefficient, Indicates the pth character value of the desensitized data, represents the qth character value of the sensitive information, represents the recovery probability weight coefficient, Indicates the preset compression ratio coefficient. represents the average uncertainty of the desensitized data, ( ) represents the occurrence probability of the pth character value of the desensitized data, The weight coefficient indicating that the desensitized data contains sensitive information, Indicates the function of judging sensitive information. Indicates the desensitized data. If the desensitized data has sensitive features, the matching degree is determined to be the maximum abnormal value; If the matching degree is greater than the preset sensitivity threshold, it is determined that the desensitization effect does not meet the standard and does not meet the business logic requirements. Otherwise, the desensitization effect meets the standard.

8. The method for protecting sensitive port information based on data desensitization according to claim 1 is characterized in that: Use secure data transmission protocols to share desensitized data with authorized users, including: The data analysis and sharing module uses a secure data transmission protocol to share desensitized data with authorized users; During the sharing process, the desensitized data is digitally signed and encrypted, and the data analysis sharing module has a built-in data analysis engine to perform data analysis operations on the desensitized data and generate data forecasts and statistical reports; An audit log system is established in the data analysis and sharing module to record detailed information on the sharing and analysis of desensitized data. The use of desensitized data is monitored in real time through the monitoring system. If any abnormal operation is found, an alarm will be issued in a timely manner.

Images