A method, system and server for differentiated access control of enterprise data assets

Abstract

The application provides a differentiated access control method, system and server for enterprise data assets, and a data desensitization processing technical field. The method comprises the following steps: obtaining an access request of a user to enterprise data, wherein the access request comprises a data use; determining target data based on the access request; determining a data desensitization strategy based on the data use; and performing desensitization processing on the target data based on the data desensitization strategy to obtain desensitized data and return the desensitized data to the user. The scheme can realize differentiated access control of enterprise data, and in data analysis use, can realize safe desensitization of private data and retain the correlation between cross-data, thereby retaining greater data analysis value.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data desensitization processing, in particular to a differentiated access control method and system for enterprise data assets and a server. BACKGROUND

[0002] In the digital era, data assets have become one of the core assets of enterprises and organizations, and their value is reflected in driving business decisions, optimizing business processes, and innovating products and services. However, the application of data assets is mainly in data analysis, and the cost of conducting internal enterprise data analysis without relying on any external platform or tool that may leak data is huge. Relying on external platforms or deployed analysis models, in order to ensure data security and prevent the leakage of private data, core data and other data, data desensitization is essential.

[0003] However, the existing data desensitization strategy loses a lot of information after desensitizing the data, and most importantly, the desensitization loses the correlation between data, resulting in a significant decrease in analysis value, and incomplete desensitization can also cause the risk of private data leakage.

[0004] In addition, different roles within an enterprise have different data access permissions and can access different data, and different data uses require different desensitization processing schemes. Therefore, how to provide a differentiated enterprise data asset access control scheme that ensures the security of private data through data desensitization while preserving the analysis value is a technical problem that needs to be solved in the field. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a differentiated access control method and system for enterprise data assets to achieve differentiated access control of enterprise data, and in data analysis, to achieve safe desensitization of private data while preserving the correlation between cross-data, thereby preserving greater data analysis value.

[0006] To achieve the above purpose, the embodiments of the present application are implemented by the following ways:

[0007] In a first aspect, the embodiments of the present application provide a differentiated access control method for enterprise data assets, comprising: obtaining a user's access request for enterprise data, wherein the access request contains data usage; determining the target data based on the access request; determining the data desensitization strategy based on the data usage; and desensitizing the target data based on the data desensitization strategy to obtain desensitized data and return it to the user.

[0008] In a first possible implementation manner of the first aspect, the target data is determined based on the access request, including: determining a user role based on a user ID in the access request; determining a request data set based on a data request parameter in the access request; and determining the target data from the request data set based on the user role.

[0009] In a second possible implementation manner of the first aspect, the data desensitization strategy is determined based on the data usage, including: if the data usage is a data analysis task, determining a first strategy as the data desensitization strategy, where the desensitization processing method of the first strategy does not include a random-type desensitization method and a shielding-type desensitization method, so as to maintain the cross-data business correlation between the desensitized data after the desensitization processing; and if the data usage is a data display task, determining a second strategy as the data desensitization strategy, where the desensitization processing method of the second strategy includes the random-type desensitization method or the shielding-type desensitization method.

[0010] In a third possible implementation manner of the first aspect, when the data desensitization strategy is the first strategy, the target data is desensitized based on the data desensitization strategy, including: determining sensitive fields involved in each piece of enterprise data in the target data to obtain a sensitive field set; and determining a matched desensitization method from a first desensitization method library based on a sensitive field type in the sensitive field set, to implement desensitization processing on each piece of enterprise data, where the first desensitization method library does not include the random-type desensitization method and the shielding-type desensitization method.

[0011] In a fourth possible implementation manner of the first aspect, the matched desensitization method is determined from the first desensitization method library based on the sensitive field type in the sensitive field set, to implement the desensitization processing on each piece of enterprise data, including: for each piece of enterprise data in the target data: determining the sensitive fields in the piece of enterprise data, and processing each sensitive field as follows: if the sensitive field type is a unique identification type, performing encryption conversion based on a user-perception-based differential format reservation encryption method to implement desensitization processing on the sensitive field of the unique identification type; if the sensitive field type is a direct identification type, performing desensitization processing based on a user-perception-based differential virtual mapping method to implement desensitization processing on the sensitive field of the direct identification type; if the sensitive field type is an indirect identification type, performing desensitization processing based on a generalization desensitization method to implement desensitization processing on the sensitive field of the indirect identification type; and if the sensitive field type is a sensitive numerical value type, performing desensitization processing based on a numerical perturbation method to implement desensitization processing on the sensitive field of the sensitive numerical value type.

[0012] In a fifth possible implementation form of the first aspect, in the fourth possible implementation form of the first aspect, the encryption conversion is performed by using a user-perception-based differential format-preserving encryption method, and the desensitization of the unique-identification-type sensitive field is implemented, including: generating a user-specific key based on a user ID in the access request and by using a format-preserving encryption algorithm in combination with a master key; performing differential format-preserving encryption on the unique-identification-type sensitive field based on the user-specific key to obtain desensitized data of the encrypted output, which replaces the unique-identification-type sensitive field.

[0013] In a sixth possible implementation form of the first aspect, in the second possible implementation form of the first aspect, when the data desensitization strategy is the second strategy, the target data is desensitized based on the data desensitization strategy, including: determining sensitive fields involved in each piece of enterprise data in the target data to obtain a sensitive field set; determining a matched desensitization method from a second desensitization method library based on a sensitive field type in the sensitive field set to implement desensitization of each piece of enterprise data, wherein the second desensitization method library contains a random-type desensitization method and a masking-type desensitization method.

[0014] In the second aspect, the embodiments of the present application provide a differential access control system for enterprise data assets, including: a request acquisition module configured to acquire an access request of a user to enterprise data, wherein the access request contains a data purpose; a data determination module configured to determine target data based on the access request; a strategy determination module configured to determine a data desensitization strategy based on the data purpose; and a desensitization processing module configured to desensitize the target data based on the data desensitization strategy to obtain desensitized data and return the desensitized data to the user.

[0015] In the third aspect, the embodiments of the present application provide a storage medium arranged in a server, including a stored program, wherein the program, when running, controls the server where the storage medium is arranged to perform the differential access control method for enterprise data assets according to any one of the first aspect or the possible implementation forms of the first aspect.

[0016] In the fourth aspect, the embodiments of the present application provide a server, including a memory and a processor, wherein the memory is configured to store information including program instructions, and the processor is configured to control the execution of the program instructions, and the program instructions, when loaded and executed by the processor, implement the differential access control method for enterprise data assets according to any one of the first aspect or the possible implementation forms of the first aspect.

[0017] Advantages:

[0018] The scheme obtains an access request of a user to enterprise data (including data use); determines target data based on the access request; determines a data desensitization strategy based on the data use; and performs desensitization processing on the target data based on the data desensitization strategy, to obtain desensitized data and return the desensitized data to the user. The scheme constructs a dynamic data security access and desensitization system, and effectively solves the contradiction between data security and analysis value through a fine-grained strategy scheduling mechanism. Traditional desensitization schemes often use a static and one-size-fits-all processing method, either over-desensitizing for the sake of security, resulting in loss of data correlation and statistical characteristics and distortion of analysis results, or under-desensitizing for the sake of retaining utility, which poses a serious data leakage risk. The scheme introduces data use, together with the role of the user, to form the core of differentiated access. After receiving an access request, the system can determine the role of the user through the user ID, complete basic data access permission filtering, and ensure that the user can only access target data within the permission range. Then, the data use in the request is deeply analyzed. If the data use is for a data analysis task, the first strategy is triggered, randomization and masking methods that can destroy correlation are strictly disabled, and a series of advanced utility-preserving algorithms are used to retain the correlation between desensitized data. If the data use is for a data display task, the second strategy is enabled, and traditional methods such as masking are allowed to quickly hide sensitive information. This intention-based differentiated processing ensures that the output data form is highly matched with the final use scenario, thereby achieving an optimal balance between security and usability.

[0019] In the first strategy (data analysis scenario), the fine-grained desensitization processing methods for different sensitive field types work together to eliminate the sensitivity of sensitive fields while retaining the analysis value of the data. For unique identification type fields, the scheme adopts a user perception-based differentiated format retention encryption method. By using a key derivation function, the master key is combined with the user ID to generate a unique encryption key for each user. For direct identification type fields, a user perception-based differentiated virtual mapping method is used for desensitization processing to achieve desensitization of direct identification type sensitive fields, which makes the same original data accessed by different users get different desensitization results, achieving perfect data isolation. However, for the same user, all data correlation can be almost completely maintained because the same original value will always be encrypted into the same false value, supporting JOIN operation in data analysis tasks, user behavior sequence analysis, cross-data fusion analysis, and other complex modeling, effectively retaining the analysis value of the desensitized data. For sensitive numerical fields, numerical perturbation (such as applying a uniform random multiplier to the entire data column, such as 1.23, 0.89, etc.) is used, which perfectly maintains the distribution pattern, statistical mean, variance, and other key characteristics of the data, making the machine learning model training and macro statistical analysis conclusions based on this data still accurate and reliable. For indirect identification type fields, generalization is used to remove sensitive details while retaining the classification distribution and semantic logic of the data. This series of desensitization processing collectively constitutes a system that can resist privacy leakage risks and maximize support for data analysis businesses.

[0020] In order to make the above objectives, features and advantages of the present application more apparent, the following will describe a preferred embodiment in detail, and the accompanying drawings will be described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 The flowchart of the differentiated access control method for enterprise data assets provided by the embodiments of the present application.

[0023] Figure 2 The structural block diagram of the differentiated access control system for enterprise data assets. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0025] As Figure 1 shown, Figure 1 the flowchart of the enterprise data asset differentiated access control method provided by the embodiment of the present application.

[0026] In the embodiment, the enterprise data asset differentiated access control method is applied to the server, which can include steps S10, S20, S30 and S40.

[0027] Firstly, when the user needs to access the enterprise data asset (such as customer order data, production order data, logistics data, etc.), the user can log in the system through the user's account identity, submit the data request parameter (such as the sales data of XX product combination in the first quarter of 20XX) that needs to be accessed, select the data use (such as data analysis task or data display task), and then generate an access request.

[0028] Accordingly, the server can run step S10.

[0029] Step S10: Obtain the user's access request for enterprise data, wherein the access request contains the data use.

[0030] In the embodiment, the server can obtain the user's access request for enterprise data.

[0031] After obtaining the access request, the server can run step S20.

[0032] Step S20: Determine the target data based on the access request.

[0033] In the embodiment, the server can parse the access request to determine the user ID, data request parameter, data use, etc. in the access request.

[0034] Accordingly, the server can determine the user role based on the user ID in the access request, such as the general manager of the marketing department, the manager of XX department, the salesperson, etc., each role corresponding to different data access permissions.

[0035] Then, the server can determine the request data set based on the data request parameter in the access request. For example, the general manager of the marketing department needs to access the sales data of XX product combination in the first quarter of 20XX, and the use is data analysis business.

[0036] Then, the server can determine the target data that meets the data access permission corresponding to the user role from the request data set based on the user role.

[0037] After determining the target data, the server can run step S30.

[0038] Step S30: Determine the data desensitization strategy based on the data use.

[0039] In this embodiment, the server can determine the data de-sensitization strategy based on the data usage.

[0040] If the data usage is a data analysis task, the server determines that the first strategy is the data de-sensitization strategy, and the de-sensitization processing method of the first strategy does not include random-type de-sensitization methods and shielding-type de-sensitization methods, so as to maintain the cross-data business correlation between the de-sensitized data after de-sensitization processing. The specific de-sensitization method of the first strategy is selected from the first de-sensitization method library, and the first de-sensitization method library does not include random-type de-sensitization methods and shielding-type de-sensitization methods.

[0041] If the data usage is a data display task, the server determines that the second strategy is the data de-sensitization strategy, and the de-sensitization processing method of the second strategy includes random-type de-sensitization methods or shielding-type de-sensitization methods. The specific de-sensitization method of the second strategy is selected from the second de-sensitization method library, and the second de-sensitization method library can include random-type de-sensitization methods and shielding-type de-sensitization methods, such as random replacement methods (for example, a rule-based random generation method, that is, randomly generating data according to a pre-defined rule library, or a word library-based random selection, that is, randomly selecting a data from a pre-set virtual data pool), partial shielding methods (keeping a specific part of the data and covering the rest with mask characters such as *, X, etc.), and the like.

[0042] After determining the data de-sensitization strategy, the server can perform step S40.

[0043] Step S40: Based on the data de-sensitization strategy, the target data is de-sensitized to obtain de-sensitized data and return to the user.

[0044] In this embodiment, for the case where the data de-sensitization strategy is the first strategy:

[0045] The server can determine the sensitive fields involved in each piece of enterprise data in the target data by matching and identifying the sensitive fields through the rule library matching method by scanning the metadata (such as field names, annotations, etc.) and sample data (such as data values) of the data table, and using a pre-set keyword dictionary, to obtain a set of sensitive fields.

[0046] For example, if the field name contains name, it is classified as name (belongs to direct identification type); if the field name contains id, idno, id_card, it is classified as identity ID (belongs to unique identification type); if the field name contains price, cost, income amount, unit price, price, etc., it is classified as amount (belongs to sensitive numerical type); if the field name contains phone, mobile, mobile phone, etc., it is classified as mobile phone number (belongs to direct identification type, not defined as unique identification type, because the same customer may have multiple different contact numbers); for example, if the field name contains age, birthday, age, birthday, etc., it is classified as age / birthday (belongs to indirect identification type); if the field name contains addr, address, location, city, address, location, city, etc., it is classified as address / location (belongs to indirect identification type).

[0047] Accordingly, after the server obtains the set of sensitive fields, it can determine the matching desensitization method from the first desensitization method library based on the sensitive field type in the set of sensitive fields, and realize desensitization processing of each piece of enterprise data.

[0048] For example, for each piece of enterprise data in the target data: the server can determine the sensitive field in this piece of enterprise data, and process each sensitive field as follows:

[0049] If the sensitive field type is unique identification type (unique identification type data, such as customer ID, internal contract number, internal order number, transaction serial number, express number, etc.), a user-perception-based differentiated format-preserving encryption method is used for encryption conversion, realizing desensitization processing of the unique identification type sensitive field.

[0050] Specifically, the server can generate a user-specific key by using a format-preserving encryption algorithm combined with a master key based on the user ID in the access request, and further use the user-specific key to perform differentiated format-preserving encryption on the unique identification type sensitive field, to obtain encrypted output desensitization data, and replace the unique identification type sensitive field, realizing desensitization processing of the unique identification type sensitive field.

[0051] For example, user-specific key = KDF (master key, user ID):

[0052] KDF is a key derivation function, such as HMAC-SHA256, which is a one-way function used to derive a unique sub-key from the master key and user ID as a user-specific key. The master key is a highest secret, stored in a hardware security module or cloud key management service, and never exposed to the application program of the system.

[0053] So, the desensitization process is: user-specific ciphertext = FPE_Encrypt (user-specific key, plaintext data), which can obtain uniform and relatively independent (different users have different user-specific keys, and the same plaintext data is different after format-preserved encryption, but the same user-specific key is the same after format-preserved encryption of different data, so it can preserve cross-data association, greatly preserve the analytical value of desensitized data, and preserve strong data isolation), and FPE_Encrypt is a format-preserved encryption algorithm.

[0054] Here is an example, assuming there are two users:

[0055] User A, UserID = "00000001";

[0056] User B, UserID = "00000002";

[0057] Their query data involves the order information of the same customer (assuming the customer ID is "CU123450"):

[0058] For the access request initiated by user A, the server captures its identity UserID = "00000001" and the customer ID "CU123450" in the data to be queried;

[0059] The server generates a user-specific key (send a request to the HSM: please derive a user-specific key for user UserID = "00000001"; the HSM performs the calculation: Key_00000001 = KDF (Master_Key, 00000001); the HSM returns the calculation result to the server as the user-specific key for user "00000001");

[0060] The server performs differential format-preserved encryption (the HSM uses Key_00000001 to perform differential format-preserved encryption on the plaintext: CipherText_00000001 = FPE_Encrypt (Key_00000001, "CU123450"), assuming the output is "SA789012" (a string with the same format and length as the original text);

[0061] The server replaces the customer ID "CU123450" with the encrypted data "SA789012" in the data queried by user A (a data copy, not the original data in the database), implements desensitization, and returns the desensitized data to user A;

[0062] For the access request initiated by user B, the server captures its identity UserID="00000002" and the customer ID "CU123450" in the data to be queried;

[0063] The server generates a user-specific key (send a request to the HSM: please derive a user-specific key for user UserID="00000002"; the HSM performs the calculation: Key_00000002=KDF(Master_Key, 00000002); the HSM returns the calculation result to the server as the user-specific key for user "00000002");

[0064] The server performs differential format-preserving encryption (the HSM uses Key_00000002 to perform differential format-preserving encryption on the plaintext: CipherText_00000002=FPE_Encrypt(Key_00000002, "CU123450"), assuming the output is "BT345678" (a string of the same format and length as the original text);

[0065] The server replaces the customer ID "CU123450" with the encrypted data "BT345678" in the data queried by user B (a copy of the data, not the original data in the database), implements desensitization, and returns the desensitized data to user B.

[0066] Differential format-preserving encryption is deterministic, i.e., the same data and the same key will point to the same output after encryption, so this can preserve the association across data; different users correspond to different user-specific keys, pointing to different outputs, achieving data isolation between users.

[0067] If the sensitive field type is direct identification type (e.g., name, name, mobile phone number, email address, etc.), use the differential virtual mapping method based on user perception for desensitization to achieve desensitization of direct identification type sensitive fields.

[0068] Here, the differential virtual mapping method based on user perception is to introduce UserID on the basis of the virtual mapping method, and the improvement idea is similar to the differential format-preserving method based on user perception, but the specific processing flow is different, and the scope of application is different, and this method has a great advantage in processing Chinese text.

[0069] Specifically, the server can generate a user-specific hash (a hash of the user ID) based on the user ID in the access request, combine a seed hash (a fixed hash value that needs to be kept secret, such as a hash value generated by SHA256 processing based on the name of the virtual mapping dictionary), and then use the sum of the seed hash, the user-specific hash, and the sensitive field hash (obtained by performing a hash of the direct-identification-type sensitive field, such as SHA256) to obtain the mapping index by taking the remainder of the total word quantity of the virtual mapping dictionary, thereby determining the virtual mapping data as the desensitization data of the direct-identification-type sensitive field and replacing the direct-identification-type sensitive field, thereby achieving desensitization processing of the direct-identification-type sensitive field.

[0070] It should be noted that the calculation of the hash value mentioned in the embodiment refers to the calculation of the original binary hash value, not the converted hexadecimal string. The remainder calculation here needs to be calculated in the same base (binary) as the sum of the hash and the total word quantity of the virtual mapping dictionary. In addition, the possible mapping collision rate (i.e., different sensitive fields corresponding to the same virtual mapping word) caused by the size of the virtual mapping dictionary has little actual impact on data analysis business and does not need to be considered.

[0071] If the sensitive field type is indirect identification type (such as age, date, address, etc.), a generalization desensitization method is used for desensitization processing to achieve desensitization processing of the indirect identification type sensitive field. Generalization processing is a common desensitization processing scheme, which will not be described in detail here. For example, range operation is performed on numerical values, precision reduction operation is performed on dates (such as generalizing specific year, month, and day to year or month), and specific addresses can be generalized to cities or districts.

[0072] If the sensitive field type is sensitive numerical type (such as order amount, product quantity, etc.), a numerical perturbation method is used for desensitization processing to achieve desensitization processing of the sensitive numerical type sensitive field. Numerical perturbation is also a common desensitization processing scheme, which will not be described in detail here. For example, the original value is multiplied by a predetermined coefficient (such as 1.23, 0.89, etc.).

[0073] In this way, the server can complete the desensitization processing of various sensitive fields of each piece of enterprise data in the target data.

[0074] And for the case where the data desensitization strategy is the second strategy:

[0075] The server can determine the sensitive fields involved in each piece of enterprise data in the target data, obtaining a sensitive field set (similar operations as described above, which will not be repeated here). Based on the sensitive field types in the sensitive field set, a matched desensitization method is determined from a second desensitization method library (which can include random-type desensitization methods and shielding-type desensitization methods), and desensitization processing is performed on each piece of enterprise data.

[0076] Since the purpose of the enterprise data is display, cross-data association does not need to be considered, and many methods can be used, and are mature, for example, directly shielding all sensitive fields (for example, replacing each character in the sensitive field with * or X), or randomly replacing all sensitive fields, but such methods result in poor content readability, and the embodiment uses a shielding-type desensitization method.

[0077] After the processing of the target data is finally completed, the server can return the desensitized data to the user.

[0078] As shown in Figure 2 The embodiment of the application also provides a differentiated access control system for enterprise data assets, which includes: a request acquisition module, configured to acquire an access request of a user for enterprise data, wherein the access request includes a data purpose; a data determination module, configured to determine target data based on the access request; a policy determination module, configured to determine a data desensitization policy based on the data purpose; and a desensitization processing module, configured to perform desensitization processing on the target data based on the data desensitization policy, to obtain desensitized data and return the desensitized data to the user.

[0079] In the embodiment, the data determination module is configured to: determine a user role based on a user ID in the access request; determine a request data set based on a data request parameter in the access request; and determine target data that meets a data access permission corresponding to the user role from the request data set based on the user role.

[0080] In the embodiment, the policy determination module is configured to: when the data purpose is a data analysis task, determine a first policy as the data desensitization policy, wherein the desensitization processing method of the first policy does not include a random-type desensitization method and a shielding-type desensitization method, to maintain cross-data business association between desensitized data after desensitization processing; and when the data purpose is a data display task, determine a second policy as the data desensitization policy, wherein the desensitization processing method of the second policy includes a random-type desensitization method or a shielding-type desensitization method.

[0081] In the embodiment, when the data de-sensitization strategy is the first strategy, the de-sensitization processing module is configured to: determine sensitive fields involved in each piece of enterprise data in the target data to obtain a sensitive field set; determine a matched de-sensitization method from the first de-sensitization method library based on a sensitive field type in the sensitive field set, and implement de-sensitization processing on each piece of enterprise data, wherein the first de-sensitization method library does not contain a random type de-sensitization method and a shielding type de-sensitization method.

[0082] In the embodiment, the de-sensitization processing module is configured to: for each piece of enterprise data in the target data: determine sensitive fields in the enterprise data, and perform the following processing on each sensitive field: if the sensitive field type is a unique identification type, perform encryption conversion based on a user perception-based differential format reservation encryption method to implement de-sensitization processing on the unique identification type sensitive field; if the sensitive field type is a direct identification type, perform de-sensitization processing based on a user perception-based differential virtual mapping method to implement de-sensitization processing on the direct identification type sensitive field; if the sensitive field type is an indirect identification type, perform de-sensitization processing based on a generalization de-sensitization method to implement de-sensitization processing on the indirect identification type sensitive field; and if the sensitive field type is a sensitive numerical value type, perform de-sensitization processing based on a numerical value perturbation method to implement de-sensitization processing on the sensitive numerical value type sensitive field.

[0083] In the embodiment, the de-sensitization processing module is configured to: generate a user-specific key based on a user ID in the access request and a format reservation encryption algorithm combined with a master key; perform differential format reservation encryption on the unique identification type sensitive field based on the user-specific key to obtain de-sensitized data of the encrypted output, and replace the unique identification type sensitive field.

[0084] In the embodiment, when the data de-sensitization strategy is the second strategy, the de-sensitization processing module is configured to: determine sensitive fields involved in each piece of enterprise data in the target data to obtain a sensitive field set; determine a matched de-sensitization method from the second de-sensitization method library based on a sensitive field type in the sensitive field set, and implement de-sensitization processing on each piece of enterprise data, wherein the second de-sensitization method library contains a random type de-sensitization method and a shielding type de-sensitization method.

[0085] The embodiment of the present application provides a storage medium arranged in a server, comprising a stored program, wherein the program controls the server where the storage medium is located to perform the differential access control method for enterprise data assets of the embodiment when the program is running.

[0086] In addition, the embodiment of the present application also provides a server comprising a memory and a processor, wherein the memory is configured to store information comprising program instructions, and the processor is configured to control the execution of the program instructions, and the program instructions loaded and executed by the processor implement the differential access control method for enterprise data assets of the embodiment.

[0087] In summary, the embodiments of the present application provide a differentiated access control method, system and server for enterprise data assets. The method comprises: obtaining an access request of a user to enterprise data (including data use); determining target data based on the access request; determining a data desensitization strategy based on the data use; and performing desensitization processing on the target data based on the data desensitization strategy to obtain desensitized data and return the desensitized data to the user. The present scheme constructs a dynamic data security access and desensitization system, and effectively solves the contradiction between data security and analysis value through a fine-grained strategy scheduling mechanism. Traditional desensitization schemes often use static and one-size-fits-all processing methods. Either excessive desensitization is pursued to cause loss of data correlation and statistical characteristics and distortion of analysis results, or insufficient desensitization is performed to cause serious data leakage risks. The present scheme introduces data use and user roles to form the core of differentiated access. After receiving an access request, the system can determine the role of the user through the user ID to complete basic data access permission filtering and ensure that the user can only access target data within the permission range. Then, the data use in the request is deeply analyzed. If the data use is for a data analysis task, a first strategy is triggered to strictly disable randomization and masking methods that can destroy correlation, and a series of advanced utility preservation algorithms are used to retain the cross-data correlation of desensitized data. If the data use is for a data display task, a second strategy is enabled to allow the use of traditional masking methods to quickly hide sensitive information. This intention-based differentiated processing ensures that the output data form is highly matched with the final use scenario, thereby achieving an optimal balance between security and usability.

[0088] In the first strategy (data analysis scenario), the refined desensitization processing methods for different sensitive field types work together to eliminate the sensitivity of sensitive fields while retaining the analysis value of the data. For unique identification type fields, the scheme uses a user perception-based differentiated format retention encryption method. By using a key derivation function, the master key is combined with the user ID to generate a unique encryption key for each user. For direct identification type fields, a user perception-based differentiated virtual mapping method is used for desensitization processing to achieve desensitization of direct identification type sensitive fields. This allows the same raw data to be accessed by different users to obtain different desensitization results, achieving perfect data isolation. However, for the same user, all data correlations are almost completely maintained because the same original value will always be encrypted into the same false value, supporting complex modeling such as JOIN operations in data analysis tasks, user behavior sequence analysis, and cross-data fusion analysis, effectively retaining the analysis value of the desensitized data. For sensitive numerical fields, numerical perturbation (such as applying a uniform random multiplier to the entire data column, such as 1.23, 0.89, etc.) is used. This perfectly maintains the distribution of the data, the statistical mean, the variance, and other key characteristics, making the machine learning model training and macro statistical analysis conclusions based on this data still accurate and reliable. For indirect identification type fields, generalization is used to remove sensitive details while retaining the classification distribution and semantic logic of the data. This series of desensitization processing collectively forms a system that can resist privacy leakage risks while maximizing support for data analysis businesses.

[0089] The above only describes the embodiments of the present application and is not used to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A differentiated access control method for enterprise data assets, characterized in that, include: Obtain user access requests for enterprise data, where the access requests include the purpose of the data; Based on the access request, the target data is determined; Based on the intended use of the data, a data anonymization strategy was determined; Based on the data anonymization strategy, the target data is anonymized to obtain anonymized data and return it to the user. Based on the intended use of the data, data anonymization strategies were determined, including: If the data is intended for data analysis tasks, the first strategy is determined to be a data anonymization strategy. The anonymization processing method of the first strategy does not include random anonymization methods or masking anonymization methods, so as to maintain the cross-data business relevance between the anonymized data after anonymization processing. If the data is intended for data display, the second strategy is determined to be a data anonymization strategy. The anonymization methods of the second strategy include random anonymization methods or masking anonymization methods. When the data anonymization strategy is set to the first strategy, the target data is anonymized based on the data anonymization strategy, including: Identify the sensitive fields involved in each piece of enterprise data in the target data to obtain a set of sensitive fields; Based on the sensitive field types in the sensitive field set, a matching desensitization method is determined from the first desensitization method library to achieve desensitization processing for each piece of enterprise data. The first desensitization method library does not contain random desensitization methods or masking desensitization methods. Based on the sensitive field types in the sensitive field set, matching desensitization methods are determined from the first desensitization method library to perform desensitization processing on each piece of enterprise data, including: For each piece of enterprise data in the target data: identify the sensitive fields in this piece of enterprise data, and process each sensitive field as follows: If the sensitive field type is a unique identifier, an encryption conversion method based on user-perception differentiated format retention is used to achieve desensitization of the unique identifier sensitive field; If the sensitive field type is direct identifier, a user-perception-based differentiated virtual mapping method is used for desensitization to achieve desensitization of direct identifier sensitive fields; If the sensitive field type is indirect identifier, a generalized desensitization method is used to perform desensitization processing to achieve desensitization processing for indirect identifier sensitive fields; If the sensitive field type is a sensitive numeric type, the numeric perturbation method is used for desensitization processing to achieve the desensitization processing of sensitive numeric fields; A user-perceived differentiated format preservation encryption method is used for encryption conversion to achieve desensitization of sensitive fields with unique identifiers, including: Based on the user ID in the access request, a user-specific key is generated by combining the key derivation function with the master key; based on the user-specific key, a differentiated format preservation encryption is performed on the uniquely identifying sensitive field to obtain the encrypted desensitized data, which replaces this uniquely identifying sensitive field. A user-perception-based differentiated virtual mapping method is used for desensitization to achieve desensitization of directly identified sensitive fields, including: A user-specific hash is generated based on the user ID in the access request. The sum of the seed hash, user-specific hash, and sensitive field hash is used to take the remainder of the total number of words in the virtual mapping dictionary to obtain the mapping index, thereby determining the virtual mapping data. This data is then used as the de-identified data for this directly identifying sensitive field and replaces the directly identifying sensitive field, thus achieving the de-identification processing of the directly identifying sensitive field. The seed hash is a fixed hash value that needs to be kept confidential and is generated based on the name of the virtual mapping dictionary. The seed hash, user-specific hash, and sensitive field hash are obtained based on a unified hash processing method.

2. The differentiated access control method for enterprise data assets according to claim 1, characterized in that, Based on the access request, the target data is determined, including: The user role is determined based on the user ID in the access request; The requested dataset is determined based on the data request parameters in the access request; Based on user roles, target data that matches the data access permissions corresponding to the user roles is determined from the request dataset.

3. The differentiated access control method for enterprise data assets according to claim 1, characterized in that, When the data anonymization strategy is the second strategy, the target data is anonymized based on the data anonymization strategy, including: Identify the sensitive fields involved in each piece of enterprise data in the target data to obtain a set of sensitive fields; Based on the sensitive field types in the sensitive field set, a matching desensitization method is determined from the second desensitization method library to achieve desensitization processing for each piece of enterprise data. The second desensitization method library includes random desensitization methods and masking desensitization methods.

4. A differentiated access control system for enterprise data assets, characterized in that, include: The request retrieval module is used to retrieve user access requests for enterprise data, where the access request includes the purpose of the data. The data determination module is used to determine the target data based on the access request; The strategy determination module is used to determine the data anonymization strategy based on the purpose of the data. The data anonymization module is used to anonymize target data based on data anonymization strategies, obtain anonymized data, and return it to the user. The strategy determination module is used to: if the data is used for data analysis tasks, determine a first strategy as a data anonymization strategy, wherein the anonymization processing method of the first strategy does not include random anonymization methods or occlusion anonymization methods, so as to maintain the cross-data business relevance between the anonymized data after anonymization processing; if the data is used for data display tasks, determine a second strategy as a data anonymization strategy, wherein the anonymization processing method of the second strategy includes random anonymization methods or occlusion anonymization methods; The desensitization module is used to: identify the sensitive fields involved in each piece of enterprise data in the target data to obtain a set of sensitive fields; and, based on the sensitive field types in the set of sensitive fields, determine the matching desensitization method from the first desensitization method library to perform desensitization processing on each piece of enterprise data. The first desensitization method library does not contain random desensitization methods or masking desensitization methods. The data masking module is used to: identify sensitive fields in each piece of enterprise data within the target data, and process each sensitive field as follows: If the sensitive field type is a unique identifier, an encryption conversion method based on user-perception differentiated format preservation is used to achieve data masking for unique identifier sensitive fields; if the sensitive field type is a direct identifier, a data masking process based on user-perception differentiated virtual mapping is used to achieve data masking for direct identifier sensitive fields; if the sensitive field type is an indirect identifier, a generalized data masking method is used to achieve data masking for indirect identifier sensitive fields; if the sensitive field type is a sensitive numerical value, a numerical perturbation method is used to achieve data masking for sensitive numerical value sensitive fields. The de-identification processing module is used to: generate a user-specific key based on the user ID in the access request by combining the key derivation function with the master key; and perform differential format preservation encryption on the uniquely identifying sensitive fields based on the user-specific key to obtain encrypted de-identified data, which replaces the uniquely identifying sensitive fields. The desensitization module is used to: generate a user-specific hash based on the user ID in the access request; use the sum of the seed hash, user-specific hash, and sensitive field hash to take the remainder of the total number of words in the virtual mapping dictionary to obtain the mapping index, thereby determining the virtual mapping data, which is used as the desensitized data for this directly identifying sensitive field, and replaces this directly identifying sensitive field, thus realizing the desensitization processing of directly identifying sensitive fields. Among them, the seed hash is a fixed hash value that needs to be kept confidential, generated based on the name of the virtual mapping dictionary, and the seed hash, user-specific hash, and sensitive field hash are obtained based on a unified hash processing method.

5. A storage medium, characterized in that, The storage medium is located within a server and includes a stored program, wherein, when the program is running, it controls the server where the storage medium is located to execute the differentiated access control method for enterprise data assets as described in any one of claims 1 to 3.

6. A server comprising a memory and a processor, the memory for storing information including program instructions, and the processor for controlling the execution of the program instructions, characterized in that: When the program instructions are loaded and executed by the processor, they implement the steps of the differentiated access control method for enterprise data assets as described in any one of claims 1-3.

Images