Dynamic desensitization processing method for electronic data

Abstract

The invention is applicable to the technical field of desensitization processing, and provides a dynamic desensitization processing method for electronic data, which comprises the following steps of: calculating to obtain a query intention convergence degree score based on a received electronic data access request; according to the method, when the electronic data access request is received, firstly, the field range, the filtering condition, the aggregation behavior and the connection of the query statement are deeply analyzed, the convergence degree score is calculated, the score directly maps the field desensitization granularity, the desensitization degree is made to be close to the query intention, and result distortion caused by excessive shielding is avoided; then, an external communication path is tracked according to the quasi identifier and the asset map, the information arbitrage risk is quantified according to the continuous multiplication probability and the sensitive value, a cut-off instruction is triggered when the risk exceeds the threshold, and instant isolation and cross-domain assembly blocking are carried out on a high-risk field.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of desensitization processing, and particularly relates to a dynamic desensitization processing method for electronic data. BACKGROUND

[0002] The technical field of desensitization processing focuses on removing or converting identifiable information without affecting the usability of data, to ensure that data meets regulatory and privacy compliance requirements during development testing, data analysis, sharing and circulation, and cross-domain collaboration.

[0003] Most existing desensitization processing technologies use fixed rules to mask key fields during data storage or offline export, rely on pre-set mask templates and static permission lists, lack awareness of real-time query intent, lack tracking means for external information fusion paths, and are difficult to dynamically adjust the desensitization granularity according to the access context. When encountering complex connections and cross-table aggregation, due to the static rules taking effect according to the field dimension, the desensitization granularity is often too coarse, and the analysis value is limited; or in the case of non-covered fields, desensitization gaps occur, leading to sensitive leakage. Lack of comprehensive measurement of external information source connection probability and sensitive value, data sharing cannot accurately identify high-risk requests, often sacrificing business efficiency with a one-size-fits-all approach. SUMMARY

[0004] The purpose of the present application is to provide a hospital internal network security access method, which aims to solve the technical problems existing in the prior art identified in the background.

[0005] The present application is implemented as follows: a dynamic desensitization processing method for electronic data, the method comprising: Obtaining an electronic data access request and calculating a query intent convergence score. Specifically, by analyzing the access request, extracting feature parameters such as the number of filter fields, the number of logical operators, the frequency of aggregate function calls, the JOIN nesting level, the number of JOIN fields, the total number of target fields, and the total number of filterable fields, and then calculating the normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity, and field selection ratio, the query intent convergence score is generated to quantify the accuracy and relevance of the access request.

[0006] The quasi-identifier to be queried is read from the electronic data access request, the associated graph of the data asset is combined, and the associated path connectable to the external information source is identified and tracked. By analyzing the field type pointed by the quasi-identifier, all connectable nodes in the data asset associated graph are traversed, the complete associated path satisfying the cross-source connection condition is located, and the continuous operation is carried out based on the connection probability value of each edge in the associated path, and the high-risk information associated path list is generated. On this basis, the structure of each associated path is extracted, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level of the terminal entity and the sensitive information value level corresponding to the associated target are extracted, and the information arbitrage risk assessment value is calculated by combining the connection success probability value, so that the risk of data leakage and information abuse is comprehensively evaluated.

[0007] Based on the query intention convergence score and the information arbitrage risk assessment value, a dynamic data access control rule is established. The query intention convergence score is compared with the preset score interval to determine the corresponding basic fuzzification level, the information arbitrage risk assessment value is compared with the preset risk threshold, the high-risk associated path exceeding the threshold is marked, and the associated cutting instruction is generated, and finally the basic fuzzification level, the associated cutting instruction and the threshold-exceeding path marking set are packaged as the dynamic data access control rule.

[0008] The operation item in the dynamic data access control rule is analyzed, and the selected column and the connection condition in the electronic data access request are replaced based on the operation item mapping list - the selected column is directly replaced by the desensitization placeholder, and the desensitization function expression is embedded in the outer layer of the connection condition, to generate the query instruction after desensitization rewriting. The query instruction is submitted to the data platform for execution, and after receiving the query result, the data source and the processing level are marked according to the desensitization strategy to obtain and return the access-controlled desensitization data set.

[0009] The beneficial effects of the present application are: When receiving the electronic data access request, the field range, the filtering condition, the aggregation behavior and the connection depth of the query statement are analyzed and the convergence score is calculated, the score is directly mapped to the field desensitization granularity, the desensitization degree is closely related to the query intention, and the result distortion caused by excessive shielding is avoided; then the external connection path is tracked according to the quasi-identifier and the asset graph, the information arbitrage risk is quantified according to the multiplicative probability and the sensitive value, and the cutting instruction is triggered immediately when the risk exceeds the threshold, the high-risk field is immediately isolated, and the cross-domain assembly is blocked; the convergence and risk results drive the generation of dynamic rules, and the selected column and the connection condition are replaced or function-encapsulated in real time to complete the query rewriting, and the data platform can output the controlled results without copying the source data when executing the rewritten instruction, which embeds the closed loop of evaluation, decision and execution in the query stage, can adjust the desensitization level in real time and accurately block the potential arbitrage scene, while keeping the query delay at a very low level, supporting business continuous calling, security audit and traceable playback, and improving the data utilization efficiency and the privacy compliance strength. Attached Figure Description

[0010] Figure 1 A flowchart illustrating the steps of the dynamic desensitization processing method for electronic data provided in an embodiment of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0012] like Figure 1 As shown, a dynamic desensitization processing method for electronic data is provided, the method comprising: S1. Obtain the electronic data access request and calculate the query intent convergence score based on the electronic data access request; The specific steps for calculating the query intent convergence score are as follows: The SQL query statements in the electronic data access request are parsed to identify and count the number of filtering fields and logical operators in the WHERE clause. At the same time, the frequency of aggregate function calls, the nesting level of JOIN operations and the number of join fields used are counted. Combined with the table structure information obtained from the metadata, the total number of fields in the target table and the total number of fields with filtering functions are extracted to form the number of filtering fields, the number of logical operators, the frequency of aggregate function calls, the nesting level of JOIN, the number of JOIN fields, the total number of target fields and the total number of filterable fields. The usage rate of filtering fields is calculated based on the number of filtering fields and the total number of filterable fields. The normalized WHERE clause complexity index is formed by combining the number of logical operators. The JOIN structure complexity is constructed by calling the nesting level of JOIN and the number of JOIN fields. The frequency of aggregate function calls is extracted as the aggregation usage intensity. The field selection ratio is calculated by extracting the total number of fields and the number of selected columns. The normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity and field selection ratio are generated. Based on the normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity, and field selection ratio, calculate the query intent convergence score: ; in, To score the convergence of query intent, To normalize the complexity of the WHERE clause, The complexity of a JOIN structure is... For the frequency of aggregate function calls, The number of fields to select in the query. The total number of fields in the target table. the number of filter fields in the WHERE clause, the number of filter fields in the target table, the number of logical operators, the JOIN nesting level, the number of join fields used in JOIN, the logical operation penalty factor, the join complexity growth factor, , , , are the adjustment coefficients of each structural factor, respectively.

[0013] Specifically, the initial parsing work starts from the SQL query statement contained in the received electronic data access request, and through the introduction of an abstract syntax tree (AST) parser, such as using ANTLR (Another Tool for Language Recognition) and other tools, the pure text query instruction is converted into a hierarchical tree data structure according to the predefined SQL syntax rules. This structure reflects the logical composition of the original query, and the subsequent statistical and recognition work is carried out on this structured data: First, traverse the abstract syntax tree to locate the node corresponding to the WHERE clause. Under this node, recursively count the number of end field nodes that are filter conditions, and record this count value as the filter field number. At the same time, in the expression tree of this WHERE clause, identify and accumulate the number of all logical connection words (such as AND, OR, NOT) nodes, to obtain the number of logical operators. Next, the parser moves to the SELECT list node to scan whether there is an aggregate function call, such as SUM, COUNT, AVG, MAX, MIN, etc., and accumulates the total number of calls as the aggregate function call frequency. For table join operations in the query, analyze the FROM clause node by checking the nesting depth of the JOIN node to determine the JOIN nesting level. A direct TableA JOIN TableB is counted as level 1, while (TableA JOIN TableB) JOIN TableC is counted as level 2. In the ON condition expression of each JOIN, extract all the fields used for connection and count the total number of unique fields as the number of JOIN fields.

[0014] To obtain the basic information of the table structure, the system will connect to the metadata information base (such as information_schema) of the data platform by executing an independent metadata query instruction, query and extract all the field list of the target table specified in the FROM clause of the SQL statement to calculate the total number of target fields, and at the same time, determine which fields have effective filtering function according to a clear filtering standard, which is defined as: any field that has an index established in the database (including B-Tree, Hash, etc.) or whose data type is numeric, date and time, or fixed-length string (such as VARCHAR(255) and below) is considered as a field with filtering ability. The number of such fields is counted to obtain the total number of filterable fields. For example, for a query SELECT dept_name, AVG(salary) FROM employee JOIN department ON employee.dept_id = department.id WHERE employee.status = 'active' AND employee.hire_date > '2022-01-01', the parser will identify the filter fields as status and hire_date, the logical operator as AND one, the aggregate function call as AVG once, the JOIN nesting level as 1, and the JOIN fields as dept_id and id. If the employee table has 8 fields, 6 of which (such as id, status, hire_date, salary, dept_id, manager_id) meet the above filtering ability definition, then the final filter field number is 2, the logical operator number is 1, the aggregate function call frequency is 1, the JOIN nesting level is 1, the JOIN field number is 2, the target field total number is 8, and the filterable field total number is 6.

[0015] Based on the filter field number, logical operator number, aggregate function call frequency, JOIN nesting level, JOIN field number, target field total number, and filterable field total number obtained in the previous stage, the system begins to build four core measurement indicators for the final score: First, calculate the normalized WHERE clause complexity index. This process first divides the filter field number by the filterable field total number to obtain a basic filter field usage rate, which reflects the extent to which the query utilizes the available filtering conditions in the table. Subsequently, in order to quantify the role of logical operators in improving the accuracy of the query, the number of logical operators is multiplied by a predetermined logical operation penalty factor, and the result is multiplied by the filter field usage rate after being added by 1, and the penalty factor is set according to the analysis of historical query logs, and statistics show that each increase in AND or OR operator will reduce the size of the query result set by about 10% on average, so it is set to 0.1, and the specific calculation formula is: wherein is the number of filter fields, is the total number of filterable fields, is the number of logical operators, is the logical operation penalty factor; then, the JOIN structure complexity is constructed, which is based on the JOIN nesting level, and the influence of the number of JOIN fields is amplified by a connection complexity growth factor, which is also based on experience, and the value is set to 0.2, considering that multiple field connections usually mean more complex entity relationships, and the calculation method is to multiply the JOIN nesting level by the sum of 1 and the product of the growth factor and the number of JOIN fields, then the frequency of aggregate function calls is directly calculated as the aggregation usage intensity indicator, this value does not need to be further calculated, it directly reflects the degree of query on data summary analysis; Finally, the field selection ratio is calculated, by parsing the SELECT clause in the original SQL statement, the number of selected column fields returned by the query is counted, and divided by the total number of fields in the target table, to get a ratio between 0 and 1, which measures the divergence of the query intent, the more fields returned, the more divergent the intent, for example, using the previous calculation results: filter field number 2, logical operator number 1, aggregate function call frequency 1, JOIN nesting level 1, JOIN field number 2, total number of target fields 8, total number of filterable fields 6, and the number of selected column fields is 2 (dept_name and AVG(salary)), then the normalized WHERE clause complexity is calculated as (2 / 6)*(1+0.1*1)=0.367, the JOIN structure complexity is 1*(1+0.2*2)=1.4, the aggregation usage intensity is 1, and the field selection ratio is 2 / 8=0.25, the four indicator values are generated and passed to the subsequent scoring step.

[0016] For the formula for calculating the query intent convergence score, the numerator part of the formula aims to measure the "accuracy" and "complexity" of the query, a more accurate and complex query usually means that the user has a more specific goal, so its intent convergence is higher, wherein the normalized WHERE clause complexity and the JOIN structure complexity are introduced to jointly evaluate the filtering granularity and association complexity of the query, and the aggregation usage intensityThe logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of

[0017] The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of

[0018] The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of The logarithmic processing of

[0019] The logarithmic processing of For the frequency of aggregate function calls, this parameter is obtained by directly counting the number of aggregate functions such as COUNT, SUM, AVG, etc. in SQL queries. Aggregate operations represent the user's intention to count and summarize data, rather than retrieve raw detailed data. High-frequency aggregate usage is usually related to analytical or reporting queries, which have a relatively convergent intention and low risk. In the example, the value is 1.

[0020] For the number of selected fields in the query, this parameter is obtained by parsing the SELECT part of the SQL statement and counting the number of columns included in the final output. This parameter is directly related to how wide the data is exposed. The more columns selected, the more information leaked in a single query, and the more divergent the intention of the query. In the example, the value is 2.

[0021] For the total number of fields in the target table, this parameter is obtained from the data dictionary or metadata information, representing the total number of attributes included in the main table being queried. It is the basis for calculating the field selection ratio, used to convert the absolute number of to a relative proportion, so as to achieve comparable evaluation across queries of different tables. In the example, the value is 8.

[0022] , , , are the adjustment coefficients of each structural factor. These coefficients are not fixed values, but are obtained through machine learning regression training on a standardized query sample library. The specific setting process is as follows: First, the data security expert team manually reviews 500 representative historical query logs, and according to the business background, complexity, and sensitive data involvement of each query, manually scores the "query intention convergence degree" with a score range of 0-10, forming a benchmark data set.

[0023] Then, take the various structured parameters of the 500 queries ( , , , ) as input features, and the expert score as the target value, and use a gradient boosting decision tree model to train, automatically learn and determine the best coefficients by optimizing the loss function.

[0024] For example, after training, the model finds that the WHERE clause constraints have the greatest impact on intention convergence, while the impact of aggregate functions is relatively small, and finally obtains a set of adjustment coefficients, for example: the WHERE clause complexity adjustment coefficient is set to 2.8, and the JOIN structure complexity adjustment coefficient is set to 1.2, the aggregation strength adjustment coefficient is set to 0.5, the field selection penalty adjustment coefficient is set to 3.5.

[0025] Embodiment 1: According to the example results of the preceding steps, the values of each parameter are as follows: normalized WHERE clause complexity ; JOIN structure complexity ; aggregation function invocation frequency ; number of fields selected in the query ; total number of fields in the target table ; the adjustment coefficient values of each structure factor are: , , , .

[0026] Substitute the above parameter values into the query intent convergence score formula: ;

[0027] The results show that the query intent convergence score of this SQL query is 1.4689. This value is a dimensionless comprehensive score that quantifies the risk level and target specificity of the query request. The system will preset a set of mapping rules between the score interval and the risk level, for example, scores between 0-2 are defined as "high risk / low convergence", scores between 2-5 are defined as "medium risk / medium convergence", and scores above 5 are defined as "low risk / high convergence". The current calculated score of 1.4689 falls within the "high risk / low convergence" interval, which sends a clear signal to the data security system: the query intent is relatively divergent and may pose a potential data leakage risk. Therefore, the subsequent data access control strategy will be based on this score to select a more stringent basic fuzzing level, such as performing high-intensity desensitization on some fields in the returned results, such as complete masking or type-preserved formatting masking.

[0028] S2, reads the quasi-identifier to be queried from the electronic data access request, and identifies and traces the associated paths that can be connected to external information sources in combination with the data asset association graph, calculates the connection success probability of each associated path, generates a high-risk information association path list, and obtains an information arbitrage risk assessment value in combination with a preset sensitive information value; 1. The specific steps of generating a high-risk information association path list are: Read the quasi-identifier to be queried from the electronic data access request, and based on the set of quasi-identifiers to be queried, parse the field type pointed to by the quasi-identifier; All connectable nodes in the data asset association graph are traversed, all complete association paths meeting the cross-source connection condition are located, and continuous operation is performed in combination with the connection probability value corresponding to each edge in the association path to generate a high-risk information association path list.

[0029] Example 2:

[0030] Based on the set of quasi-identifiers to be queried extracted from the initial electronic data access request, such as the fields containing “name” and “company mailbox”, the system starts the path discovery process: First, it is determined through metadata analysis that “name” is a string type and “company mailbox” is a string type conforming to a specific format, and they are used as starting nodes for graph traversal. The graph here is a pre-constructed data asset association graph, which is a directed and weighted graph. The nodes in the graph represent specific fields in all data assets in the enterprise (such as db1.user.name), and the edges represent the association between fields. The weight of the edge is the connection probability value, which is determined according to a set of hierarchical rules: if there is a database foreign key constraint between two fields, the connection probability value is 1.0; if there is no foreign key but the field names and data types are completely identical (such as order.user_id and log.user_id), the probability value is 0.95; if the field names are matched through a synonym dictionary (a dictionary pre-maintained by data governance experts, containing items such as “phone”, “mobile phone”, “contact information”, etc.) and the data types are compatible, the probability value is 0.85; if the Jaccard similarity calculated from the sample data exceeds 0.8 (this threshold is set by analyzing the data distribution of historical successful association cases and taking the 80% percentile), the probability value is 0.8.

[0031] The traversal process uses a depth-first search algorithm, starting from the “name” and “company mailbox” nodes and exploring along the edges in the graph. Each time the path extends from a node in one data source (such as CRM_DB) to a node in another data source (such as HR_System_DB), it is considered a cross-source connection. The algorithm continues to explore until the path reaches a terminal node marked as “highly sensitive” (such as HR_System_DB.employee.id_card_number) or the path length exceeds the preset upper limit of 10 layers. This upper limit is set to prevent infinite loops and control computational overhead, and is determined based on statistical analysis of the average path length of the graph. During the traversal process, the total connection success probability of each complete path (from the starting point to the highly sensitive terminal point) is obtained by multiplying the connection probability values of all edges in the path. For example, a path passes through three edges with probabilities of 0.95, 0.85, and 1.0, respectively, and the total connection success probability of the path is 0.8075.

[0032] Finally, all the paths with total connection success probability exceeding 0.7 are screened out to form a high-risk information correlation path list, and the threshold of 0.7 is set according to the risk acceptance strategy, aiming to balance the business query demand and data security, which represents the risk level of the attacker with a higher possibility of successfully correlating information.

[0033] 2. The information arbitrage risk assessment value is obtained, and the specific steps are: According to the high-risk information correlation path list, the structure of each correlation path is extracted, the number of field co-occurrence pairs, the number of cross-domain jumps, and the structural integrity level of the end entity in the correlation path are extracted, and the sensitive information value level corresponding to the correlation target of the correlation path is extracted, to generate the connection success probability value, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level, and the sensitive information value level of each correlation path. According to the connection success probability value, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level, and the sensitive information value level of each correlation path, the information arbitrage risk assessment value is calculated: ; Wherein, is the information arbitrage risk assessment value, represents the connection success probability of the hth path (obtained by multiplying all edge connection probabilities in the path), represents the value level of the sensitive information correlated by the hth path (such as 10 for an ID number and 5 for a mobile phone number), represents the structural integrity level of the end entity of the hth path, represents the number of field co-occurrence pairs in the hth path, represents the number of cross-domain jumps in the hth path, is the cross-domain jump complexity index factor, is the cross-domain risk growth proportion coefficient, represents the total number of reachable paths.

[0034] Embodiment 3: According to the high-risk information correlation path list generated in the previous step, the system performs detailed structured feature extraction on each path in the list: First, for the extraction of the number of field co-occurrence pairs, the system analyzes each data table or entity node passed by the path. In each node, all pairs of co-occurring quasi-identifiers or sensitive information fields are identified and counted. For example, if a path passes through the customer_info table, which contains both "mobile phone number" and "home address" fields, it is counted as one co-occurrence pair. If it subsequently passes through the transaction_log table containing "transaction amount" and "credit card number", it adds another co-occurrence pair. Finally, the number of co-occurrence pairs on the entire path is accumulated to obtain the number of field co-occurrence pairs of the path. Second, for the extraction of the number of cross-domain jumps, the system checks the attributes of each edge in the path. These edges are marked during the construction of the graph as to whether they cross a predefined "data domain". The data domain is divided based on the system's physical deployment (such as different database instances), business attribution (such as sales domain, financial domain), or security level (such as core area, non-core area). Each time the path moves from a node in one domain to a node in a different domain, the number of cross-domain jumps increases by one. Next, the system evaluates the structural completeness level of the path endpoint entity. This level is calculated using a quantitative formula: where N is the total number of all possible attributes associated with the entity type, is the i-th attribute, is an indicator function that takes the value 1 if the path can successfully associate to attribute , and 0 otherwise, is the importance weight of attribute i, which is evaluated by the data governance committee based on the business value and sensitivity of the attribute (for example, core identifier weight is 1.0, auxiliary information is 0.5). The calculated value is then mapped to a level from 1 to 5 according to a pre-set interval, for example, 0-0.2 is level 1, 0.2-0.4 is level 2, and so on. Finally, the sensitive information value level corresponding to the path association target is extracted. This operation is completed by querying a pre-set sensitive information classification and level table. This table is developed by the information security department based on national standards and industry regulations (such as GDPR, Personal Information Protection Law), which clearly specifies the value level of various sensitive information (such as ID number, mobile phone number, medical record). For example, ID number is level 10, mobile phone number is level 5. After completing all the above extractions, the system encapsulates the original connection success probability value, the calculated number of field co-occurrence pairs, the number of cross-domain jumps, the structural completeness level, and the sensitive information value level of each path into a structured record, and finally generates a set containing all high-risk paths and their complete feature parameters.

[0035] For the formula of computing the information arbitrage risk assessment value, the formula has the benefit that it can identify the highest risk from numerous potential data leakage paths, thereby accurately quantifying the risk. The formula does not simply add up each risk factor, but rather, through multiplication and non-linear functions, more truly reflects the compounded effect of the risk.

[0036] The base risk value is composed of the connection success probability of the path , the value of sensitive information , and the information integrity , which reflects that risk is the product of "possibility" and "harmfulness". Only when a path is easy to be successfully connected and the information it points to is extremely valuable and complete, the base risk will be high. Further, the formula introduces the consideration of "attack complexity" through . The term captures the risk growth brought by field co-occurrence through the logarithmic function, reflecting the marginal effect that the more information dimensions, the more the risk increases but the growth slows down. And The term greatly amplifies the risk brought by cross-domain jumping through the exponential function, accurately depicting the technical difficulty and the steep increase of risk in data correlation between different systems. Finally, The operation ensures that the final assessment result reflects the "worst case", i.e. the maximum potential risk that the entire query request can trigger, providing the most critical and direct basis for subsequent access control decisions.

[0037] The total number of reachable paths, which refers to the sum of all paths that can successfully connect to any sensitive information node in the data asset correlation graph from the to-be-queried quasi-identifier. This value is directly counted by the aforementioned path traversal step. For example, after one traversal, 3 paths that meet the conditions are found, then .

[0038] represents the connection success probability of the hth path, which measures the possibility of an attacker successfully associating to the target sensitive information along a specific path. It is obtained by multiplying the connection probabilities of all edges in the path, and these probability values are determined based on foreign key, field name / type matching, content similarity, etc. in the previous step. A typical example is: a path successively passes through user.id and order.user_id (foreign key connection, probability 1.0), order.address_id and address.id (name similarity and type matching, probability 0.95), and address.zipcode and external credit.zip (content similarity 0.88), then the .

[0039] represents the value level of sensitive information associated with the hth path, which is a quantitative indicator reflecting the harm degree that the sensitive data pointed by the path endpoint may cause once leaked. The level is predefined in a static configuration table by the data governance and information security team according to legal and regulatory requirements, business impact, and repair cost, etc. For example, the following standards can be made: identity card number, bank card number are 10 levels; mobile phone number, accurate address are 8 levels; email, work unit are 5 levels; user portrait label is 3 levels. When the endpoint of a path is the employee.id_card_number field, its value is 10.

[0040] represents the structural integrity level of the entity at the end of the hth path, which evaluates the richness of the information about the target entity that can be obtained through the path. The level is calculated by weighted sum of all possible attributes of the entity, and then mapped to a level of 1-5. The calculation formula is: where N is the total number of entity attributes, is the ith attribute, is the attribute weight, is 1 or 0 indicating whether it can be obtained. For example, a "customer" entity has 5 attributes: name , mobile phone , address , email , and registration time . If a path can associate to name, mobile phone and address, . The total weight is 3.6, . According to the grading standard (such as 0.6-0.8 corresponding to level 4), then .

[0041] represents the number of field co-occurrence pairs in the hth path, which reflects how many quasi-identifiers or sensitive information are "caught in one net" in the same data source in the association process, increasing the dimension of information exposure. The way to obtain is to check each data table passed during path traversal and calculate the number of pairs of quasi-identifiers and sensitive fields in the table. For example, the path passes through the user_profile table, which has three quasi-identifiers: name, phone, and email, so there are three pairs of co-occurrence pairs: (name, phone), (name, email), and (phone, email). The contribution value of this node is 3.

[0042] ​represents the number of cross-domain jumps in the h-th path, which quantifies the complexity and technical threshold of information association. The more system boundaries crossed, the higher the risk. Data domains are divided according to business systems, database instances, or network security domains. In the graph, each edge that crosses different domains is marked, and the number of marked edges is accumulated when the path planning algorithm traverses to obtain . For example, the path from the customer table in the CRM library to the order table in the ERP library, and then to the user_log table in the big data platform, .

[0043] is the cross-domain jump complexity exponential factor, which is an empirical parameter used to simulate the exponential growth of risk when associating data across systems. Its setting is based on the analysis of known data breach incidents, and the ability of attackers to obtain core data is multiplied by the number of system boundaries they have broken. Through the analysis of 50 major data breach cases, it is found that the median of this multiplication factor is about 1.6, so .

[0044] is the cross-domain risk growth proportion coefficient, which is used to balance the relative importance of field co-occurrence risk and cross-domain jump risk in the calculation of total risk. Its setting uses the analytic hierarchy process (AHP), and five senior data security experts are invited to compare and score the relative importance of “multi-field co-occurrence” and “cross-domain jump” in the final information arbitrage risk. A judgment matrix is constructed, the maximum eigenvalue and corresponding eigenvector of the matrix are calculated, and consistency test is performed. The final weight vector is (0.3, 0.7), so the adjustment coefficient of cross-domain risk is set to . Another value .

[0045] Calculation process: In this example, the pre-step found 2 high-risk paths .

[0046] Path 1: pointing to the ID number, connection success probability , sensitive information value level. , structure integrity level , field co-occurrence pair number cross-domain jump number .

[0047] Path 2: pointing to the bank card number, connection success probability , sensitive information value level ,

[0048] structure integrity level , field co-occurrence pair number , cross-domain jump number .

[0049] adjustment coefficient , .

[0050] calculate the risk value of path 1 : ; calculate the risk value of path 2 : ; compare the risk values of the two paths, and take the maximum value as the final information arbitrage risk assessment value : ; The results show that the maximum information arbitrage risk assessment value triggered by this data access request is 48.2706. This value reflects the comprehensive risk level of the attacker using this query to successfully arbitrage high-value and relatively complete sensitive information (bank card number) through the most dangerous associated path (path 2). The system will set a risk threshold, for example, 30. The setting of this threshold is based on the assessment of the organization's risk tolerance, approved by the CISO (Chief Information Security Officer), and risks below this threshold are considered acceptable. Since the currently calculated risk value 48.2706 is much greater than 30, it indicates that the query request has an unacceptably high risk. Therefore, the system must take strong intervention measures, such as in subsequent steps, specifically targeting the highest-risk path 2 (i.e. the path that spans 2 data domains and ultimately points to the bank card number) for association cutting to eliminate this main source of risk.

[0051] S3, compare the query intent convergence score with the preset score interval, select the corresponding basic fuzzification level, and at the same time determine the information arbitrage risk assessment value with the preset risk threshold, and establish a dynamic data access control rule; 1. The establishment of a dynamic data access control rule has the following specific steps: Call the query intent convergence score and compare it with the score interval boundary set in the configuration table one by one. When the query intent convergence score is less than or equal to the upper limit of any score interval and greater than the upper limit of the previous score interval, lock the score interval mapping index, and then retrieve the corresponding entry in the fuzzification level mapping table with the mapping index to generate the basic fuzzification level. Based on the basic fuzzification level, read the risk threshold, compare the information arbitrage risk assessment value with the risk threshold, if the information arbitrage risk assessment value is greater than the risk threshold, then traverse the high-risk information association path list in order, mark each association path with a threshold-exceeding mark, and generate a threshold-exceeding path mark set; Based on the threshold-exceeding path mark set, parse the quasi-identifier field in each threshold-exceeding path, construct an association cut-off instruction according to the quasi-identifier field and the data asset unique identifier splicing rule, encapsulate the basic fuzzification level, the association cut-off instruction, and the threshold-exceeding path mark set into a unified strategy structure, and form a dynamic data access control rule.

[0052] Embodiment 4: The query intention convergence score calculated in the previous step is called, which is a floating point value, for example, 1.4689. The system then starts the level mapping process, which first accesses an internal configuration table that solidifies the correspondence between the score interval boundary set and the fuzzification level. This configuration table is established based on the statistical analysis of more than ten thousand historical query logs. The data security experts divide these queries into four categories (for example, high-risk exploratory queries, medium-risk analytical queries, low-risk business queries, and no-risk regular queries) according to their nature and potential risks, and calculate the distribution of the query intention convergence scores of each category of queries. The 75th percentile, 50th percentile, and 25th percentile of the distribution are taken as the boundary values of the interval, for example, the final determined score interval boundary set is [2.0, 5.0, 8.0], which divides the score range into four intervals: (negative infinity, 2.0], (2.0, 5.0], (5.0, 8.0], and (8.0, positive infinity). Each interval is assigned a sequential index starting from 1.

[0053] Next, the system performs a loop comparison operation, comparing the incoming score 1.4689 with the upper limit values in the boundary set [2.0, 5.0, 8.0] from left to right one by one. In the first comparison, it is found that 1.4689 is less than or equal to 2.0, and it is greater than the upper limit of the previous interval (in this case, it is implicitly negative infinity). The condition is met, so the mapping index of the current interval is locked as 1, and the subsequent comparison is immediately terminated. Then, the system uses this locked mapping index 1 to search in a static fuzzy level mapping table, which defines the specific desensitization operation level corresponding to each index in detail. The content of this table is specified by the data governance strategy, for example: {1: "high-intensity desensitization", 2: "medium-intensity desensitization", 3: "low-intensity desensitization", 4: "no desensitization"}. Among them, "high-intensity desensitization" corresponds to replacing the sensitive field with a fixed mask "********", "medium-intensity desensitization" corresponds to a prefix and suffix mask, and "low-intensity desensitization" may be a data type conversion. By querying this table with index 1, the system retrieves the corresponding entry "high-intensity desensitization", and finally outputs the string as the result, generating the basic fuzzy level.

[0054] Based on the basic fuzzy level generated in the previous step, such as "high-intensity desensitization", the system then reads a globally configured risk threshold constant. This threshold, for example, is set to 30. The determination of its value is not arbitrary, but is derived from the risk acceptance statement at the organizational level. By quantitatively analyzing the potential financial losses, brand reputation damage, and legal compliance fines that may be caused by potential data leakage events, combined with the organization's business strategy and risk preference, a maximum acceptable risk exposure value is ultimately determined and solidified as a system constant. This value is reviewed every half year.

[0055] Subsequently, the system directly compares the information arbitrage risk assessment value calculated in the previous step, for example 48.2706, with the risk threshold 30. Since 48.2706 is greater than 30, the result is true, which immediately triggers the path screening process, which aims to accurately locate the specific risk source path that causes the overall risk to exceed the threshold. After the process is started, the system sequentially traverses the previously generated high-risk information association path list. For each path in the list, the system recalculates its independent risk assessment value (this value has been obtained when calculating the maximum value of the information arbitrage risk assessment value). For example, the risk value of path 1 is 44.352, and the risk value of path 2 is 48.2706. Then, the system compares the independent risk value of each path with the risk threshold 30 again. For path 1, since 44.352 is greater than 30, the system adds a Boolean flag is_over_threshold=true to the data structure of the path. For path 2, since 48.2706 is also greater than 30, it also adds the same threshold flag. After traversal is complete, the system collects all paths marked with the threshold flag to form a threshold path flag set.

[0056] Based on the threshold path flag set generated by the previous process, which contains all specific paths whose independent risk values exceed the threshold, the system begins to construct the final dynamic access control strategy: First, the system deeply analyzes each threshold path in the set and extracts the information of all nodes and edges that constitute the path, especially those as connecting key quasi-identifier fields. For example, it is found through analysis that a threshold path is achieved by associating the mobile phone number field in the customer table of the CRM database with the contact telephone field in the delivery information table of the order database. Next, the system follows a predefined quasi-identifier field and data asset unique identifier splicing rule to construct accurate association cutting instructions. The rule format is ACTION:DATASOURCE_TYPE:DATABASE_NAME.SCHEMA_NAME.TABLE_NAME.COLUMN_NAME, where ACTION is fixed as CUT_LINK, DATASOURCE_TYPE indicates the data source type such as MYSQL or HIVE, and the following is the fully qualified name of the field. For the above example, the system will generate an instruction such as CUT_LINK:MYSQL:order database.dbo.deliver information table.contact telephone. The meaning of this instruction is that in the subsequent query rewriting stage, direct access or association to this field must be prevented. The system generates similar instructions for each key connection edge in each threshold path and collects all instructions into a list. Finally, the system encapsulates the base obfuscation level generated in the first step (e.g. "high strength obfuscation"), the newly generated list of correlation cut-off instructions, and the complete set of super-threshold path markers into a unified, structured policy object, forming the dynamic data access control rule.

[0057] S4, parse the operation item in the dynamic data access control rule, replace the selected column and the connection condition in the electronic data access request, generate the query instruction after desensitization rewriting, and submit the query instruction after desensitization rewriting to the data platform and execute, and obtain the returned access-controlled desensitized data set.

[0058] 1. The generated query instruction after desensitization rewriting, the specific steps are: Parse the operation item field in the dynamic data access control rule, read the replacement instruction and encapsulation instruction, record the target selection column, connection condition and corresponding desensitization processing mode for each replacement instruction and encapsulation instruction, and form an operation item mapping list; Based on the operation item mapping list, match the selection column and the connection condition in the electronic data access request one by one, replace the matched selection column with the desensitization placeholder, and embed the desensitization function expression in the outer layer for the matched connection condition, to generate the query instruction after desensitization rewriting.

[0059] Embodiment 5: Parse the structured object of the dynamic data access control rule generated in the previous step, and extract the base obfuscation level, correlation cut-off instruction and super-threshold path marker set from it: First, process the replacement instruction corresponding to the base obfuscation level, according to the set "high strength obfuscation", "medium strength obfuscation" and other text descriptions, query a built-in desensitization function library, which maintains the mapping of descriptive levels to specific database functions, for example, "high strength obfuscation" is mapped to the MASK_ALL() function, and "medium strength obfuscation" is mapped to the MASK_PREFIX_SUFFIX(col,2,2) function. The system will determine the desensitization function that needs to be applied to all non-association conditions of sensitive selection columns in the original query according to this mapping relationship, and record it down.

[0060] Next, the system starts processing the list of association cut-off instructions, reading each instruction in the form of CUT_LINK:MYSQL:order database.dbo.shipper information table.contact phone, which is defined as a wrapping instruction, and the system will parse it as a wrapping operation on the target join condition, specifically, it will wrap any equality comparison expression in a JOIN ON or WHERE clause in the original query that involves the field order database.dbo.shipper information table.contact phone, with a constant-false expression such as 1=0, or a specific function that can be recognized by the database as a blocking join, the purpose of this wrapping is to logically cut off the association path without changing the syntax structure of the SQL, the system will record each parsed target selection column or join condition and its corresponding specific desensitization processing method (replaced by a function call or wrapped as a specific expression) as an entry, and finally form a clear operation item mapping list, which is stored in the form of key-value pairs, the key is the string representation of the target column name or join condition expression in the original SQL, and the value is the target string to be replaced or wrapped.

[0061] Based on the operation item mapping list generated in the previous step, the system starts the process of rewriting the SQL statement in the original electronic data access request, the core of which is to use Abstract Syntax Tree (AST) for accurate node replacement. The system first parses the original SQL query statement (for example, SELECT c.name, o.order_id, r.phone FROM customer c JOIN "order" o ON c.id = o.customer_id JOIN receiver_infor ON o.receiver_id = r.id WHERE c.level = 'VIP') into an AST again. Then, the system traverses each entry in the operation item mapping list. For each entry, it searches for a node matching the key in the AST. If there is an entry {key: "r.phone", value: "MASK_ALL(r.phone)"} in the list, which belongs to the selection column replacement, the system finds the column reference node r.phone in the SELECT clause list of the AST and directly replaces it with a function call node whose function name is MASK_ALL and the parameter is the original r.phone node. If there is another entry {key: "o.receiver_id = r.id", value: "1 = 0"} in the list, which belongs to the connection condition encapsulation, the system finds the binary comparison expression node that completely matches o.receiver_id = r.id in the ON condition expression of the JOIN clause and replaces it with a new constant expression node representing 1 = 0. This process is performed item by item until all instructions in the list are processed. After all replacement and encapsulation operations are completed, the system re-serializes the modified AST to generate a new text string that conforms to the SQL syntax. This string is the query instruction after desensitization rewriting, for example, the original query after rewriting becomes SELECT c.name, o.order_id, MASK_ALL(r.phone) FROM customer c JOIN "order" o ON c.id = o.customer_id JOIN receiver_infor ON 1 = 0 WHERE c.level = 'VIP'.

[0062] 2. The access-controlled desensitized data set returned is obtained, and the specific steps are as follows: Based on the desensitization rewritten query instruction, the query is submitted to the data platform for execution, and the query result is marked with the data source and processing level according to the desensitization strategy to form the returned access-controlled desensitized data set.

[0063] Embodiment 6: Based on the desensitization rewritten query instruction generated by the last process, the system submits the instruction to the back-end data platform for execution through a standard database connection protocol (such as JDBC, ODBC). The data platform, such as a relational database management system (RDBMS) or a big data query engine (such as Presto, Hive), will parse, optimize, and finally execute the rewritten instruction like any normal SQL query. Since the query instruction itself is completely legal in syntax, the database will successfully execute and return a result set. The system receives the result set returned by the data platform and does not directly pass it to the end user, but performs the last step of metadata annotation processing. The system will add additional metadata information to the returned data set according to the information in the dynamic data access control rules. Specifically, the system will add source annotations to each column of the result set, indicating which specific database, table, and field the column data comes from. At the same time, according to the adopted desensitization strategy (such as "high-strength fuzzing" and "association cut-off"), a processing level label such as "L4-highly controlled" is added to each column or the entire data set. These metadata information is encapsulated together to form the final returned access-controlled desensitized data set.

[0064] The technical features of the above-described embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described, but as long as the combinations of the technical features do not contradict, they should be considered within the scope of the present disclosure.

[0065] The above-described embodiments only express several embodiments of the present application, which are described in detail and specifically, but should not be construed as limiting the scope of the present patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of the present application. Therefore, the scope of protection of the present patent should be subject to the appended claims.

[0066] The above-described embodiments are only the preferred embodiments of the present application, and are not intended to limit the present application. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A method for dynamic desensitization processing of electronic data, characterized in that, The method includes: Obtain electronic data access requests and calculate the query intent convergence score based on the electronic data access requests; Read the quasi-identifier to be queried from the electronic data access request, and combine it with the data asset association map to identify and track the association paths that can be connected to external information sources, calculate the connection success probability of each association path, generate a list of high-risk information association paths, and obtain the information arbitrage risk assessment value by combining the preset sensitive information value. The query intent convergence score is compared with a preset score range, and the corresponding basic fuzziness level is selected. At the same time, the information arbitrage risk assessment value is compared with a preset risk threshold to establish dynamic data access control rules. The operation items in the dynamic data access control rules are parsed, the selection columns and connection conditions in the electronic data access request are replaced, a de-identified and rewritten query instruction is generated, and the de-identified and rewritten query instruction is submitted to the data platform and executed to obtain the returned access-controlled de-identified dataset.

2. The method according to claim 1, characterized in that, The specific steps for calculating the query intent convergence score are as follows: Parse electronic data access requests to obtain the number of filter fields, the number of logical operators, the frequency of aggregate function calls, the nesting level of JOIN, the number of JOIN fields, the total number of target fields, and the total number of filterable fields; The usage rate of filtering fields is calculated based on the number of filtering fields and the total number of filterable fields. The normalized WHERE clause complexity index is formed by combining the number of logical operators. The JOIN structure complexity is constructed by calling the nesting level of JOIN and the number of JOIN fields. The frequency of aggregate function calls is extracted as the aggregation usage intensity. The field selection ratio is calculated by extracting the total number of fields and the number of selected columns. The normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity and field selection ratio are generated. The query intent convergence score is calculated based on the normalized WHERE clause complexity, JOIN structure complexity, aggregation usage intensity, and field selection ratio.

3. The method according to claim 2, characterized in that, The specific steps for generating the list of high-risk information association paths are as follows: Read the quasi-identifier to be queried from the electronic data access request, and parse the field type pointed to by the quasi-identifier based on the set of quasi-identifiers to be queried; Traverse all connectable nodes in the data asset association graph, locate all complete association paths that meet the cross-source connection conditions, and perform continuous calculations based on the connection probability value corresponding to each edge in the association path to generate a list of high-risk information association paths.

4. The method according to claim 3, characterized in that, The specific steps for obtaining the information arbitrage risk assessment value are as follows: Based on the list of high-risk information association paths, structural extraction is performed on each association path. The number of field co-occurrence pairs, the number of cross-domain jumps, and the structural integrity level of the endpoint entity in the association path are extracted, as well as the sensitive information value level corresponding to the associated target of the association path. The connection success probability value, number of field co-occurrence pairs, number of cross-domain jumps, structural integrity level, and sensitive information value level of each association path are generated. The information arbitrage risk assessment value is calculated based on the success probability value of each associated path, the number of field co-occurrence pairs, the number of cross-domain jumps, the structural integrity level, and the sensitive information value level.

5. The method according to claim 4, characterized in that, The specific steps for establishing dynamic data access control rules are as follows: The query intent convergence score is called, and compared with the score interval boundary set in the configuration table. The query intent convergence score is compared with the upper limit of each score interval one by one. When the query intent convergence score is less than or equal to the upper limit of any score interval and greater than the upper limit of the previous score interval, the score interval mapping index is locked. Then, the corresponding entry is retrieved in the fuzziness level mapping table using the mapping index to generate the basic fuzziness level. Based on the aforementioned basic fuzziness level, the risk threshold is read, and the information arbitrage risk assessment value is compared with the risk threshold. If the information arbitrage risk assessment value is greater than the risk threshold, the list of high-risk information association paths is traversed in sequence, and each association path is marked with an over-threshold tag to generate an over-threshold path tag set. Based on the set of super-threshold path markers, the quasi-identifier field in each super-threshold path is parsed, and an association cutoff instruction is constructed according to the concatenation rule of the quasi-identifier field and the unique identifier of the data asset. The basic fuzziness level, the association cutoff instruction and the set of super-threshold path markers are encapsulated into a unified policy structure to form dynamic data access control rules.

6. The method according to claim 4, characterized in that, The specific steps for generating the de-identified and rewritten query command are as follows: Parse the operation item field in the dynamic data access control rule, read the replacement instruction and encapsulation instruction, and record the target selection column, connection condition and corresponding desensitization processing method for each replacement instruction and encapsulation instruction to form an operation item mapping list; Based on the operation item mapping list, the selection columns and connection conditions are matched item by item in the electronic data access request. The matched selection columns are directly replaced with de-identified placeholders, and the matched connection conditions are embedded with de-identified function expressions to generate de-identified and rewritten query instructions.

7. The method according to claim 6, characterized in that, The specific steps for obtaining the returned access-controlled de-identified dataset are as follows: Based on the de-identified and rewritten query command, the query is submitted to the data platform and executed. After receiving the query results, the data source and processing level are labeled according to the de-identification strategy to form a returned access-controlled de-identified dataset.

Images