Data desensitization display method and device

Abstract

The invention discloses a data desensitization display method and device. The method comprises the following steps: in response to a display request of to-be-displayed data sent by a target object, obtaining a biological feature vector of the target object at the current moment; target data is obtained, and the target data is obtained after the to-be-displayed data is encrypted; after the biological feature vector of the target object at the current moment is successfully authenticated, determining an encryption seed of the target object according to the biological feature vector of the target object at the current moment and pre-stored auxiliary data; generating a private key based on the encryption seed; and decrypting the target data by using the private key, and displaying the to-be-displayed data obtained after decryption. The method provided by the invention at least solves the technical problem that the display mode is single due to the fact that the data is displayed in a role-based access control mode in related technologies.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to a data anonymization display method and apparatus. Background Technology

[0002] Operators possess massive amounts of user data. During their operations, business personnel frequently need to access this data. Systems that display user data in batches suffer from two major pain points: Plaintext exposure risk: Displaying sensitive user data in plaintext format easily leads to user privacy leaks. Static data masking defects: Traditional masking (such as covering part of the characters) is irreversible; business personnel need to apply for additional permissions to view the complete data, making the process cumbersome. Existing solutions, such as field-level encryption (requiring pre-assigned keys), cannot achieve "displaying different content for the same data to different users" using role-based access control. This leads to the technical problem of using role-based access control to display data, resulting in a single display mode. Summary of the Invention

[0003] This application provides a data anonymization display method and apparatus to at least solve the technical problem that the display mode is monotonous due to the use of role-based access control in related technologies.

[0004] According to one aspect of the embodiments of this application, a data anonymization and display method is provided, comprising: in response to a display request for data to be displayed sent by a target object, obtaining the biometric vector of the target object at the current moment; obtaining target data, wherein the target data is obtained by encrypting the data to be displayed; after successful authentication of the biometric vector of the target object at the current moment, determining the encryption seed of the target object based on the biometric vector of the target object at the current moment and pre-stored auxiliary data; generating a private key based on the encryption seed; decrypting the target data using the private key, and displaying the decrypted data to be displayed.

[0005] Optionally, reconstructing the encryption seed of the target object based on the target object's biometric vector and pre-stored auxiliary data includes: acquiring the auxiliary data, wherein the auxiliary data is generated based on the original encryption seed, and the original encryption seed is determined based on the biometric vector collected during the target object's registration; determining the biometric vector collected during the target object's registration as a first vector, and determining the target object's current biometric vector as a second vector; acquiring the difference value between the first vector and the second vector; determining that the target object's current biometric vector authentication is successful if the difference value is not greater than a preset error value; and generating the target object's encryption seed based on the pre-stored auxiliary data if the target object's current biometric vector authentication is successful, wherein the target object's encryption seed is the same as the original encryption seed.

[0006] Optionally, obtaining target data includes: generating a public key based on the target object's account and obtaining a session key, wherein the session key is determined based on a random number of a preset length; using the session key to symmetrically encrypt the data to be displayed to obtain ciphertext; using the public key to encrypt the session key to obtain a packaging key; and encoding the ciphertext and the packaging key to obtain the target data.

[0007] Optionally, decrypting the target data using the private key and displaying the data to be displayed includes: decrypting the packaging key in the target data using the private key to obtain a decryption result; determining the decryption result as the session key if the length of the decryption result is equal to the length of the session key; and decrypting the ciphertext in the target data using the session key to obtain the data to be displayed.

[0008] Optionally, displaying the data to be displayed includes: determining to display the data to be displayed when the biometric vector of the target object at the current time contains only one biometric feature; and adding a watermark to the view corresponding to the data to be displayed when the biometric vector of the target object at the current time contains multiple biometric features, and displaying the data to be displayed after adding the watermark.

[0009] Optionally, the method further includes: if the biometric vector authentication of the target object fails at the current moment, outputting a de-identified view of the data to be displayed, wherein the de-identified view is generated after de-identifying the data to be displayed using a preset de-identification rule, and the preset de-identification rule corresponds one-to-one with the type of the data to be displayed.

[0010] Optionally, generating an encryption seed for the target object based on pre-stored auxiliary data includes: processing the auxiliary data and the biometric vector of the target object at the current moment using a fuzz processor to obtain the encryption seed for the target object.

[0011] According to another aspect of the embodiments of this application, a data anonymization and display device is also provided, comprising: a first acquisition module, configured to acquire the biometric vector of the target object at the current moment in response to a display request for data to be displayed sent by the target object; a second acquisition module, configured to acquire target data, wherein the target data is obtained by encrypting the data to be displayed; a determination module, configured to determine the encryption seed of the target object based on the biometric vector of the target object at the current moment and pre-stored auxiliary data after successful authentication of the biometric vector of the target object at the current moment; a generation module, configured to generate a private key based on the encryption seed; and a display module, configured to decrypt the target data using the private key and display the decrypted data to be displayed.

[0012] According to another aspect of the embodiments of this application, a computer device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-described data anonymization and display method.

[0013] According to another aspect of the embodiments of this application, a computer program product is also provided, including computer instructions that, when executed by a processor, implement the above-described data anonymization and display method.

[0014] In this embodiment, in response to a display request for data to be displayed sent by a target object, the biometric vector of the target object at the current moment is obtained; target data is obtained, wherein the target data is obtained by encrypting the data to be displayed; after successful authentication of the biometric vector of the target object at the current moment, an encryption seed for the target object is determined based on the biometric vector of the target object at the current moment and pre-stored auxiliary data; a private key is generated based on the encryption seed; the target data is decrypted using the private key, and the decrypted data to be displayed is displayed. By generating a private key based on the biometrics of each target object, the purpose of personalized content for each target object is achieved, thus achieving the technical effect of personalized display for each target object. This solves the technical problem of the single display mode caused by the use of role-based access control in related technologies. Attached Figure Description

[0015] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0016] Figure 1 This is a hardware structure block diagram of a computer terminal for implementing a data anonymization and display method according to an embodiment of this application;

[0017] Figure 2 This is a flowchart of a data anonymization and display method according to an embodiment of this application;

[0018] Figure 3 This is a control flowchart of a data anonymization and display method according to an embodiment of this application;

[0019] Figure 4 This is a flowchart of another data anonymization and display method according to an embodiment of this application;

[0020] Figure 5 This is a flowchart of a data decryption method according to an embodiment of this application;

[0021] Figure 6 This is a flowchart of a private key synthesis method according to an embodiment of this application;

[0022] Figure 7 This is a schematic diagram of the structure of a data anonymization and display system according to an embodiment of this application;

[0023] Figure 8 This is a structural diagram of a data anonymization display device according to an embodiment of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] The information collected in this application embodiment is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken. It does not violate public order and good morals, and provides corresponding operation entry points for users to choose to authorize or reject the automated decision results. If the user chooses to reject, the process will proceed to the expert decision-making process.

[0027] To address the problems existing in related technologies, this application provides a data anonymization and display method, which can be run on... Figure 1 The computer terminal shown is explained below.

[0028] The data anonymization and display method embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 A hardware structure block diagram of a computer terminal for implementing a data anonymization and display method is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission module 106 for communication functions connected via wired and / or wireless networks. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0029] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be implemented wholly or partially as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be wholly or partially integrated into any other element in the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0030] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data anonymization and display method in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned data anonymization and display method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0031] The transmission module 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission module 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0032] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0033] It should be noted here that, in some optional embodiments, the above... Figure 1 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 1This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0034] In the above operating environment, this application provides an embodiment of a data anonymization and display method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] Figure 2 This is a flowchart of a data anonymization and display method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0036] Step S202: In response to the display request for the data to be displayed sent by the target object, obtain the biometric vector of the target object at the current moment;

[0037] In step S202, the target object enters biometric features such as iris, fingerprint and facial features at a trusted terminal, and generates a biometric vector through a feature extraction algorithm. The biometric vector is then used to generate a private key.

[0038] Specifically, the process of generating biological feature vectors is shown in the following equation:

[0039] Where m = 2048

[0040] In the formula, V bio Represents a biological feature vector, v m This represents the feature components in a biological feature vector.

[0041] Step S204: Obtain target data, wherein the target data is obtained by encrypting the data to be displayed;

[0042] This application also proposes a data desensitization control process, such as... Figure 3 As shown, a user's account generates a public key through calculation, and the user's biometrics generate a private key based on the calculation. Using this public and private key pair, the RSA (an asymmetric encryption algorithm) algorithm is used to control data desensitization. The encryption of the data to be displayed is accomplished by generating a public key based on the target object's account.

[0043] The specific public key generation process is shown in the following formula:

[0044]

[0045] In the formula, A represents the account of the target object, and H(A) represents the hash operation performed on the account of the target object. Perform an XOR operation on the target object's account and a random value S, where PubKey is the generated public key.

[0046] Different acquisition strategies can be used when collecting biometric data from target objects, for example:

[0047] Fingerprint recognition: Extracting the bifurcation points (minarea points) of the fingerprint ridges;

[0048] Iris recognition: Gabor filters are used to extract iris texture features;

[0049] 3D face recognition (facial features): captures facial depth topology mesh information.

[0050] Step S206: After the biometric vector of the target object at the current moment is successfully authenticated, the encryption seed of the target object is determined based on the biometric vector of the target object at the current moment and the pre-stored auxiliary data.

[0051] Step S208: Generate a private key based on the encryption seed;

[0052] Step S210: Decrypt the target data using the private key and display the decrypted data to be displayed.

[0053] Through steps S202 to S210 above, in response to a display request for data to be displayed sent by the target object, the biometric vector of the target object at the current moment is obtained; target data is obtained, wherein the target data is obtained by encrypting the data to be displayed; after successful authentication of the biometric vector of the target object at the current moment, an encryption seed for the target object is determined based on the biometric vector of the target object at the current moment and pre-stored auxiliary data; a private key is generated based on the encryption seed; the target data is decrypted using the private key, and the decrypted data to be displayed is displayed. By generating a private key based on the biometrics of each target object, the purpose of personalized content for each target object is achieved, thus solving the technical problem of a single display mode caused by the use of role-based access control in related technologies. The following is a detailed explanation.

[0054] In practical applications, each collection of biometric features will have some differences. If a private key is directly generated based on each collected biometric feature, the generated private key will be different each time. To solve the above problem, some embodiments of this application propose a method for determining the encryption seed of the target object based on the biometric vector of the target object and pre-stored auxiliary data. The method includes: obtaining the auxiliary data, wherein the auxiliary data is generated based on the original encryption seed, and the original encryption seed is determined based on the biometric vector collected when the target object is registered; determining the biometric vector collected when the target object is registered as a first vector, and determining the biometric vector of the target object at the current moment as a second vector; obtaining the difference value between the first vector and the second vector; if the difference value is not greater than a preset error value, determining that the biometric vector of the target object at the current moment is successfully authenticated; if the biometric vector of the target object at the current moment is successfully authenticated, generating the encryption seed of the target object based on the pre-stored auxiliary data, wherein the encryption seed of the target object is the same as the original encryption seed. The method for generating the encryption seed of the target object based on the pre-stored auxiliary data is as follows: A fuzz processor is used to process the auxiliary data and the biometric vector of the target object at the current moment to obtain the encryption seed of the target object.

[0055] Let the first vector be V bio The second vector is V′ bio For example, determine ||V′ bio -V bio If || < δ, then it is considered that a fuzzing processor can be used to generate an encryption seed identical to the original encryption seed. This is illustrated in the following formula:

[0056]

[0057] in,

[0058]

[0059] (Seed,HelperData)=FuzzyExtractor(V bio )

[0060] In the formula, Seed′ represents the encryption seed of the target object, Seed represents the original encryption seed, C represents the error correction code encoding result, Rep(.) represents the recovery function of the fuzzing processor, and H(V) represents the encryption seed of the target object. bio The expression `)` represents a hash operation on the biometric feature vector, `Rep(Seed)` represents the seed repeat expansion function, `FuzzyExtractor(.)` represents the fuzzy processor function, and `HelperData` represents auxiliary data.-1 (.) indicates the inverse operation of the recovery function. This indicates that the encryption seed is solved in reverse from the error correction code encoding result and auxiliary data, and δ represents the preset error value.

[0061] Based on the above formula, the specific process of generating an encrypted seed identical to the original encrypted seed using a fuzz processor is as follows:

[0062] Receive the first vector V of the target object bio This generates the original encrypted seed (Seed) and auxiliary data (HelperData). The HelperData is used to help associate future biometric data with the Seed.

[0063] Receive the second vector V′ of the target object bio Restore the same value as Seed. If ||V′ bio -V bio If ||<δ, then it is certain that the original encryption seed (Seed) can be obtained through the fuzz processor.

[0064] Generating auxiliary data: Auxiliary data is generated using error-correcting encoding (such as BCH encoding) and XOR operations, along with a seed. The auxiliary data retrieves the original encryption seed based on a second vector without directly revealing it.

[0065] During the authentication phase, the target object provides biometric features again, generating a new biometric vector (the second vector).

[0066] Correction using auxiliary data: The second vector is combined with pre-stored auxiliary data, and through error correction coding, the second vector is corrected to generate an encryption seed that is the same as the original encryption seed.

[0067] Through the steps described above, the fuzz extractor can generate or recover the same encryption seed even when there are minor differences in biometric data, thus ensuring the reliability of biometric authentication and the stability of the encryption key. This technology plays a crucial role in biometric encryption and security authentication systems, especially in scenarios where it is necessary to recover an accurate encryption key from imprecise biometric data.

[0068] In some embodiments of this application, the specific steps for obtaining target data are as follows: generating a public key based on the target object's account and obtaining a session key, wherein the session key is determined based on a random number of a preset length; using the session key to symmetrically encrypt the data to be displayed to obtain ciphertext; using the public key to encrypt the session key to obtain a packaging key; and encoding the ciphertext and the packaging key to obtain the target data.

[0069] In this embodiment, a layered encryption approach is used to achieve the effect of encryption once and decryption on demand. The specific encryption process for the data to be displayed is as follows: Obtaining the public key: Obtain the corresponding RSA public key from the system through the target object's account, which will be used for subsequent encryption operations. Generating a session key: Create a 32-byte strong random number as the AES-GCM (an authentication encryption algorithm) session key, which will be used for symmetric encryption of the data to be displayed. Layered encryption:

[0070] The data to be displayed is encrypted as follows: Since RSA encryption can cause data inflation, the original data is encrypted using the AES-GCM algorithm (authenticated encryption mode) session key to generate ciphertext.

[0071]

[0072] In the formula, k AES A randomly generated 256-bit AES session key. Here, GMAC(k) is the encryption algorithm, M is the plaintext of the data to be displayed, τ represents the authentication tag, C represents the ciphertext, and GMAC(k) is the encryption algorithm. AES ,M) represents the authentication function.

[0073] Key Encryption: The session key is encrypted with the public key using the RSA-OAEP algorithm (Optimal Asymmetric Padding) to generate the wrapper key.

[0074] C RSA =(k AES ) e mod n

[0075] In the formula, C RSA This represents the packaging key.

[0076] The ciphertext and packaging key are encoded and converted into a securely transmittable text format (target data).

[0077] In some embodiments of this application, the specific steps for decrypting the target data using the private key and displaying the data to be displayed are as follows: The packaging key in the target data is decrypted using the private key to obtain a decryption result; if the length of the decryption result is equal to the length of the session key, the decryption result is determined to be the session key; the ciphertext in the target data is decrypted using the session key to obtain the data to be displayed. For example... Figure 4 As shown, it includes:

[0078] Step 1, User requests decryption: The user initiates a data decryption request on the front-end interface: The system obtains the encrypted data packet (containing ciphertext and wrapped_key).

[0079] It should be noted that: ciphertext: represents the ciphertext, and wrapped_key: represents the encoded wrapper key.

[0080] Step 2, Biometric Authentication: The system activates the biometric sensor (fingerprint / iris / face recognition). Successful authentication: Generates the target object's current biometric vector and enters the Trusted Execution Environment (TEE) to continue the process; Authentication failure: Directly returns a de-identified view of the data, blocking subsequent decryption operations.

[0081] It should be noted that the de-identified view is the data obtained after the data to be displayed has been de-identified, such as the target data, or it can be the data to be displayed after being de-identified according to de-identification rules.

[0082] Step 3, Private key synthesis within the TEE (after successful authentication):

[0083] Processing of the target object's biometric vector:

[0084] The biometric vector of the target object is input into the fuzz extractor, and the encrypted seed is restored by combining it with the pre-stored HelperData.

[0085] Key generation: Bind the Seed to the user account to generate a user-specific RSA private key d. PrivKey

[0086] in

[0087] Key security mechanism: The private key exists only in the TEE memory and never leaves the secure environment.

[0088] Step 4, RSA unpacking session key:

[0089] Input: Base64 decoded wrapped_key, padding validity check: session key length verification (fixed 32 bytes).

[0090] Step 5, AES decryption of data:

[0091] Input: Base64 decoded ciphertext, and unpacked session_key (session key).

[0092] Verification is performed using the AES-GCM authentication label (ensuring data integrity and authenticity): if authentication is successful, plaintext display is permitted.

[0093] Decrypt the ciphertext; if decryption fails, immediately destroy the session key in memory.

[0094] Step 6, Safely render to screen:

[0095] Output control: Decrypted data is only output to the secure display buffer, and risky operations such as clipboard copying / file saving are prohibited.

[0096] Memory cleanup: Immediately clear sensitive data such as session_key and PrivKey, and trigger the destruction of the TEE memory isolation area.

[0097] Figure 5 An interactive flowchart of a decryption process is shown, such as... Figure 5 As shown, the data storage layer first provides encrypted data to the de-identification engine, including data encrypted with AES-GCM and a session key encrypted with RSA. The de-identification engine sends a public key retrieval request to the authentication center. The authentication center responds to the de-identification engine's request and returns the user's public key, which is generated based on the user's account. After receiving the public key, the de-identification engine prompts the user to perform biometric authentication (such as fingerprint or iris scan). If biometric authentication fails, a de-identified view is sent. If authentication is successful, a password input event is triggered. After the password verification is successful, the private key is returned, and the data to be displayed is decrypted locally and displayed on the front end. The specific process of displaying the data to be displayed is as follows: if the biometric vector of the target object at the current time contains only one biometric feature, the data to be displayed is determined; if the biometric vector of the target object at the current time contains multiple biometric features, a watermark is added to the view corresponding to the data to be displayed, and the watermarked data to be displayed is then displayed.

[0098] If the biometric vector authentication of the target object fails at the current moment, a de-identified view of the data to be displayed is output. The de-identified view is generated after the data to be displayed is de-identified using a preset de-identification rule, and the preset de-identification rule corresponds one-to-one with the type of the data to be displayed. Table 1 shows an example of a de-identification rule and a de-identified view. As shown in Table 1, the data types include: name, ID number and mobile phone number. Different data types correspond to different de-identification rules, such as different de-identification functions. The de-identification view example shows that different de-identification functions correspond to different replacement character positions and character numbers. For example, s[0] means that the first character is not replaced, s[-1]$ means that the last character is not replaced, and "*" means that the character is replaced with "*".

[0099] Table 1

[0100]

[0101]

[0102] Table 2 shows the display methods corresponding to different security levels. Different security levels correspond to different triggering conditions, such as including one biometric task or two biometric authentications.

[0103] Table 2

[0104]

[0105] It should be noted that the security levels L1, L2, and L3 increase in that order.

[0106] To better illustrate the process of private key synthesis, Figure 6 A flowchart of private key synthesis is also shown, such as Figure 6As shown, the first step is user interaction and biometric data acquisition: The user presses their fingerprint or looks at the iris camera, or performs other forms of biometric input. Biometric sensors (such as fingerprint sensors and iris scanners) capture the biometric features and convert them into digital signals. The captured biometric features are processed by a feature extraction algorithm to generate a biometric vector. This vector represents a mathematical description of the user's biometric features, such as the coordinates of the bifurcation points of the fingerprint ridges, the Gabor filter coefficients of the iris texture, etc. The fuzz extractor then restores the encryption seed: The biometric vector is input into the fuzz extractor. The fuzz extractor uses pre-stored helper data to process the biometric vector, overcoming the variability during biometric acquisition and ensuring that the same encryption seed is generated even when there are slight changes in the biometric features. The fuzz extractor performs an error correction process to ensure that the encryption seed generated from the user's biometric features is stable and repeatable each time. The key synthesizer combines the encryption seed with the account to generate a private key: the generated encryption seed is combined with the user's account information, and a private key (d_PrivKey) is generated using a specific key generation algorithm (such as a hash function, XOR operation, or key derivation function KDF). This combination process ensures that the private key is a unique combination based on the user's identity and biometrics, thus achieving personalization and security with "one key per person." Once generated, the private key (d_PrivKey) is used within a Trusted Execution Environment (TEE), which provides a secure, isolated execution environment to prevent the private key from being stolen by malware or attackers. The private key is used to decrypt the previously RSA-encrypted wrapped key to recover the session key for further AES-GCM data decryption. The private key is generated based on biometrics and can only be synthesized in real-time within the secure environment of the TEE after successful biometric verification. In this way, the system ensures that data decryption operations are performed only by legitimate users. Furthermore, since the private key is generated in real-time from biometrics each time, it does not require storage or transmission, thus greatly enhancing data security. Furthermore, the use of a TEE environment ensures that private keys remain secure and are not exposed or stolen, even on untrusted networks or in untrusted environments.

[0107] Figure 7 It also shows a data anonymization demonstration, such as Figure 7As shown, the system includes: a server and a client. The client connects to the biometric sensor: this is the first point of interaction between the user and the system, responsible for collecting the user's biometric features, such as fingerprints, iris scans, or facial information. The user presses, gazes, or aligns their face with the sensor, which converts the biometric information into digital signals. Account input is received: the user needs to enter their account information into the system so that the system can identify the user and associate their biometric features with their public key. The TEE (Trusted Execution Environment) is a secure, isolated area on the client device, responsible for protecting the biometric data and private key generation process from external software or malicious code. The TEE provides a secure environment for private key synthesis after successful biometric authentication. The key binding engine runs within the TEE and is responsible for combining the encrypted seed from the biometric data with the user's account to generate a user-specific RSA private key. The private key is used to decrypt the session key, thereby enabling data decryption. The server stores AES-GCM encrypted data and RSA encrypted session keys. This data is provided when the client initiates a request. Data anonymization service: This service handles data anonymization, transforming data into an anonymized view based on user permissions and roles, such as partially obscuring phone numbers or ID card numbers. Anonymized data is displayed when a user requests it but has not completed biometric authentication. Front-end rendering: This is the part where the server interacts with the client. It receives requests, renders the anonymized or decrypted data, and securely presents it to the user. Front-end rendering dynamically adjusts the data display method based on the user's authentication status.

[0108] User Request: The user enters their account information and initiates a data viewing request on the front-end display interface. At this time, the system will display preliminary anonymized data according to the user's permissions. Public Key Acquisition: The front-end display sends a public key acquisition request to the server. The server's anonymization service connects to the key binding engine through "public key registration" and returns the RSA public key corresponding to the user's account. Biometric Authentication: The user performs biometric authentication on the front-end interface. If authentication is successful, the biometric vector is input into the key binding engine in the TEE for private key synthesis. Private Key Synthesis: Within the TEE, the fuzz extractor uses the biometric vector and pre-stored HelperData to reconstruct the encryption seed, and then combines the seed with the user's account information to generate the RSA private key. Session Key Unpacking: The private key is used to decrypt the RSA-encrypted session key (Wrapped Key) stored in the encrypted data storage. Through decryption, the session key is recovered. Data Decryption: The session key is passed to the front-end rendering, and the AES-GCM algorithm is used to decrypt the ciphertext stored in the encrypted data storage. At the same time, the GCM authentication label is verified to ensure the integrity and authenticity of the data. Secure Display: Decrypted data is securely rendered to the user's screen, existing only temporarily in TEE memory and immediately destroyed after display to ensure data security. Screen rendering is protected by an anti-screenshot mechanism to prevent unauthorized copying or storage of data. Through this collaboration, the system ensures that anonymized data is displayed before authentication, while the full data is displayed only after the user has authenticated via biometrics and securely generated a private key, and then decrypted locally on the client side. This approach not only protects data privacy but also enhances the user experience. Furthermore, the decentralized key management strategy reduces the risk of key leakage, strengthening the overall system security.

[0109] Figure 8 A data anonymization display device is shown, the device comprising:

[0110] The first acquisition module 80 is used to acquire the biometric vector of the target object at the current moment in response to the display request of the data to be displayed sent by the target object.

[0111] The second acquisition module 82 is used to acquire target data, wherein the target data is obtained by encrypting the data to be displayed;

[0112] The determination module 84 is used to determine the encryption seed of the target object based on the biometric vector of the target object at the current time and the pre-stored auxiliary data after the biometric vector authentication of the target object at the current time is successful.

[0113] Generation module 86 is used to generate a private key based on the encryption seed;

[0114] The display module 88 is used to decrypt the target data using the private key and display the decrypted data to be displayed.

[0115] The aforementioned data anonymization and display device responds to a display request for data to be displayed sent by a target object by acquiring the target object's current biometric vector; acquiring target data, wherein the target data is obtained by encrypting the data to be displayed; after successful authentication of the target object's current biometric vector, determining the target object's encryption seed based on the target object's current biometric vector and pre-stored auxiliary data; generating a private key based on the encryption seed; decrypting the target data using the private key, and displaying the decrypted data to be displayed. By generating a private key based on the biometrics of each target object, the device achieves the goal of providing personalized content for each target object, thus solving the technical problem of a single display mode caused by the use of role-based access control in related technologies.

[0116] The determining module 84 includes a determining submodule, used to determine the encryption seed of the target object based on the biometric vector of the target object and pre-stored auxiliary data, including: acquiring the auxiliary data, wherein the auxiliary data is generated based on the original encryption seed, and the original encryption seed is determined based on the biometric vector collected during the registration of the target object; determining the biometric vector collected during the registration of the target object as a first vector, and determining the biometric vector of the target object at the current moment as a second vector; acquiring the difference value between the first vector and the second vector; if the difference value is not greater than a preset error value, determining that the biometric vector of the target object at the current moment has been successfully authenticated; if the biometric vector of the target object at the current moment has been successfully authenticated, generating the encryption seed of the target object based on the pre-stored auxiliary data, wherein the encryption seed of the target object is the same as the original encryption seed.

[0117] The determination submodule includes an acquisition unit for acquiring target data, comprising: generating a public key based on the target object's account and acquiring a session key, wherein the session key is determined based on a random number of a preset length; symmetrically encrypting the data to be displayed using the session key to obtain ciphertext; encrypting the session key using the public key to obtain a packaging key; and encoding the ciphertext and the packaging key to obtain the target data.

[0118] The acquisition unit includes a decryption subunit, used to decrypt the target data using the private key and display the data to be displayed, including: decrypting the packaging key in the target data using the private key to obtain a decryption result; determining the decryption result as the session key if the length of the decryption result is equal to the length of the session key; and decrypting the ciphertext in the target data using the session key to obtain the data to be displayed.

[0119] The acquisition unit also includes a display subunit, used to display the data to be displayed, including: determining to display the data to be displayed when the biometric vector of the target object at the current time contains only one biometric feature; and adding a watermark to the view corresponding to the data to be displayed and displaying the data to be displayed after adding the watermark when the biometric vector of the target object at the current time contains multiple biometric features.

[0120] The aforementioned data anonymization and display device further includes a display submodule, used to output an anonymized view of the data to be displayed when the biometric vector authentication of the target object fails at the current moment. The anonymized view is generated after the data to be displayed is anonymized using preset anonymization rules, and the preset anonymization rules correspond one-to-one with the type of the data to be displayed.

[0121] The determination submodule also includes a generation unit, which is used to generate an encryption seed for the target object based on pre-stored auxiliary data, including: using a fuzz processor to process the auxiliary data and the biometric vector of the target object at the current time to obtain the encryption seed of the target object.

[0122] It should be noted that, Figure 8 The data anonymization display device shown is used to perform Figure 2 The data anonymization display method shown above applies to this data anonymization display device as well, and will not be repeated here.

[0123] This application also provides a computer device, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor, connected to the memory, is used to execute the above-described data anonymization and display method.

[0124] The data anonymization and display method executed by the aforementioned computer equipment responds to a display request for data to be displayed sent by a target object by obtaining the target object's current biometric vector; obtaining target data, wherein the target data is obtained by encrypting the data to be displayed; after successful authentication of the target object's current biometric vector, determining the target object's encryption seed based on the target object's current biometric vector and pre-stored auxiliary data; generating a private key based on the encryption seed; decrypting the target data using the private key, and displaying the decrypted data to be displayed. By generating a private key based on the biometrics of each target object, the method achieves the goal of providing personalized content for each target object, thus solving the technical problem of a single display mode caused by the use of role-based access control in related technologies.

[0125] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the data anonymization and display method in this application.

[0126] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0127] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0128] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0131] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0132] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for anonymizing and displaying data, characterized in that, include: In response to a display request for data to be displayed sent by the target object, the biometric vector of the target object at the current moment is obtained; Obtain target data, wherein the target data is obtained by encrypting the data to be displayed; After the biometric vector of the target object at the current moment is successfully authenticated, the encryption seed of the target object is determined based on the biometric vector of the target object at the current moment and the pre-stored auxiliary data. Generate a private key based on the encrypted seed; The target data is decrypted using the private key, and the decrypted data to be displayed is then presented.

2. The method according to claim 1, characterized in that, The encryption seed of the target object is reconstructed based on the target object's biometric vector and pre-stored auxiliary data, including: The auxiliary data is obtained, wherein the auxiliary data is generated based on the original encryption seed, and the original encryption seed is determined based on the biometric vector collected when the target object is registered; The biometric vector collected during the registration of the target object is determined as the first vector, and the biometric vector of the target object at the current moment is determined as the second vector; Obtain the difference value between the first vector and the second vector; If the difference value is not greater than a preset error value, it is determined that the biometric vector authentication of the target object at the current moment is successful; If the biometric vector authentication of the target object is successful at the current moment, an encryption seed for the target object is generated based on pre-stored auxiliary data, wherein the encryption seed of the target object is the same as the original encryption seed.

3. The method according to claim 2, characterized in that, Obtain the target data, including: A public key is generated based on the target object's account, and a session key is obtained, wherein the session key is determined based on a random number of a preset length; The data to be displayed is symmetrically encrypted using the session key to obtain ciphertext; The session key is encrypted using the public key to obtain the packaging key; The target data is obtained by encoding the ciphertext and the packaging key.

4. The method according to claim 3, characterized in that, The target data is decrypted using the private key, and the data to be displayed is then presented, including: The private key is used to decrypt the packaging key in the target data to obtain the decryption result; If the length of the decryption result is equal to the length of the session key, the decryption result is determined to be the session key; The ciphertext in the target data is decrypted using the session key to obtain the data to be displayed.

5. The method according to claim 4, characterized in that, The data to be displayed includes: If the biometric vector of the target object at the current moment contains only one biometric feature, then the data to be displayed is determined to be displayed. If the biometric vector of the target object at the current moment contains multiple biometric features, a watermark is added to the view corresponding to the data to be displayed, and the watermarked data to be displayed is then shown.

6. The method according to claim 1, characterized in that, The method further includes: If the biometric vector authentication of the target object fails at the current moment, a de-identified view of the data to be displayed is output. The de-identified view is generated after the data to be displayed is de-identified using a preset de-identification rule, and the preset de-identification rule corresponds one-to-one with the type of the data to be displayed.

7. The method according to claim 2, characterized in that, Generating an encryption seed for the target object based on pre-stored auxiliary data includes: A fuzz processor is used to process the auxiliary data and the biometric vector of the target object at the current moment to obtain the encryption seed of the target object.

8. A data anonymization display device, characterized in that, include: The first acquisition module is used to acquire the biometric vector of the target object at the current moment in response to the display request of the data to be displayed sent by the target object. The second acquisition module is used to acquire target data, wherein the target data is obtained by encrypting the data to be displayed; The determination module is used to determine the encryption seed of the target object based on the target object's current biometric vector and pre-stored auxiliary data after the target object's current biometric vector authentication is successful. The generation module is used to generate a private key based on the encryption seed; The display module is used to decrypt the target data using the private key and display the decrypted data to be displayed.

9. A computer device, characterized in that, include: A memory and a processor, wherein the memory is used to store program instructions; The processor, connected to the memory, is used to execute the data anonymization and display method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the data anonymization and display method according to any one of claims 1 to 7.

Images