Method for encrypting and decrypting sensitive data in large language model generation code
By designing a dedicated cryptographic table and a state machine algorithm to encrypt and decrypt sensitive data field names, the problem of sensitive data protection in the code generated by the large language model is solved, achieving efficient information desensitization and code generation quality assurance.
Patent Information
- Application Number
- CN202511086866.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-05
- Publication Date
- 2025-11-28
AI Technical Summary
Existing technologies are insufficient to effectively protect sensitive data during the code generation process of large language models, leading to the risk of information leakage. Furthermore, traditional desensitization methods may affect the quality of code generation or be incomplete.
Design a dedicated password table, encrypt sensitive data field names on the client side using a state machine algorithm, and decrypt them on the server side to ensure that the noun and semantic meaning of the fields remain unchanged before and after encryption. Decryption is performed using regular expressions.
It achieves complete desensitization of sensitive information, ensures code generation quality, does not affect user experience and understanding of large language models, and avoids the risk of information leakage.
Smart Images
Figure CN121030767A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to a method for encrypting and decrypting sensitive data in code generated by a large language model, and belongs to the field of large model data encryption and decryption. BACKGROUND
[0002] With the rapid development of artificial intelligence technology, large models (especially code generation large models) are increasingly widely used in the field of software development. Such models can automatically generate code segments or complete programs that meet user needs based on the prompt words input by the user, significantly improving development efficiency and reducing the threshold for manual coding.
[0003] In actual application, the prompt words submitted by the user to the large model usually contain multiple types of key information to ensure the accuracy and applicability of the generated code, such as user demand text, reference code, and existing code. However, a large amount of sensitive data is often implied in the above information, and once data leakage or attack occurs in external services, the core information security of the user will be directly threatened.
[0004] Currently, some enterprises choose to completely avoid external large model services and rely only on local development tools, but this limits the ability of advanced large models to play. Another part of the enterprises calls external services after simple data desensitization processing, but traditional desensitization methods are difficult to deal with complex sensitive information in the code context (such as business rules implied in the code logic), which can distort the requirements, reduce the readability of the code, and result in poor code generation effect returned by the large model; it can also lead to incomplete desensitization or damage to the effectiveness of the prompt words, thereby affecting the code generation quality. SUMMARY
[0005] The application provides a method for encrypting and decrypting sensitive data in code generated by a large language model, which designs a special password table to avoid directly handing over related business sensitive data to external large model interfaces while ensuring the correct and efficient generation of code.
[0006] To solve the above technical problems, the application includes the following technical solutions:
[0007] A method for encrypting and decrypting sensitive data in code generated by a large language model, comprising:
[0008] A preset password table, each row in the password table points to a field name of sensitive data, including a pre-encryption field name and a post-encryption field name, the post-encryption field name includes a general field name and a numerical code, the pre-encryption field name and the general field name have the same part of speech and semantics;
[0009] In the process that the AI coding tool client sends a prompt word request to the server, the processing end intercepts the prompt word request and forwards it to the server after encryption; the prompt word request includes the current code and user demand; the encryption process is that, based on a password table, a state machine algorithm is used to find the field name of the matching sensitive data in the prompt word request, and the field name before encryption in the prompt word request is replaced by the field name after encryption;
[0010] In the process that the server returns response content to the AI coding tool client, the processing end intercepts the response content and forwards it to the AI coding tool client after decryption; the decryption process is that, by using a simple regular expression, the response content is found and matched based on the field name after encryption, and is replaced by the field name before encryption.
[0011] Further, the field name before encryption includes a Chinese field name before encryption and an English field name before encryption;
[0012] The field name after encryption includes a Chinese field name after encryption corresponding to the Chinese field name before encryption, and an English field name after encryption corresponding to the English field name before encryption.
[0013] Further, the Chinese field name before encryption in the password table is a device type, and the corresponding encrypted general field name is device; the English field name before encryption is a device type, and the corresponding encrypted general field name is equipment; the numerical code is an M-digit value, and M is 1-6.
[0014] Further, the Chinese field name before encryption in the password table is an attribute type, and the corresponding encrypted general field name is attribute; the English field name before encryption is an attribute type, and the corresponding encrypted general field name is property; the numerical code is an N-digit value, and N is 1-6.
[0015] Further, the setting process of the password table is:
[0016] Based on a specific project, the Chinese field name of the entity and attribute that needs to be desensitized is sorted out; the corresponding English field name is uniformly defined; the encryption rule is defined, specifically the general field name and the numerical code are defined.
[0017] Further, the password table also includes a note column, which is supplementary information of the field name; the supplementary information includes one or more of the associated field, the field type, the unit, the data storage length, and whether it is a required item.
[0018] Further, when the password table includes a note column, the processing end intercepts the prompt word request and forwards it to the server after encryption, and the note information table is also sent to the server; the note information table includes the field name after encryption replaced in the encryption process of the processing end and the content of the corresponding note column.
[0019] Compared with the prior art, the method for encrypting and decrypting sensitive data in a large language model code provided by the present application has the following advantages and positive effects: the password table is set based on specific projects, and the sensitive information can be completely desensitized. In addition, the field name before encryption and the general field name after encryption have the same part of speech and semantics, so as to avoid intrusive modification and not affect the semantic understanding of the large language model server to the encrypted prompt word, thereby ensuring the quality of the returned response. Furthermore, the state machine algorithm is used for efficient encryption processing, and the constraint rule is used for efficient decryption processing, and the processing end processing process is non-sensing operation of the AI coding tool client, without the need for additional user operation, without affecting the user experience. BRIEF DESCRIPTION OF DRAWINGS
[0020] Figure 1 The structural diagram of an embodiment of the present application. DETAILED DESCRIPTION
[0021] The method for encrypting and decrypting sensitive data in a large language model code provided by the present application will be further described in detail below in combination with the drawings and specific embodiments. The advantages and features of the present application will be clearer in combination with the following description. It should be noted that the drawings are very simplified and use non-precise proportions, and are only used to facilitate and clarify the purpose of assisting the description of the embodiments of the present application.
[0022] The method for encrypting and decrypting sensitive data in a large language model code provided by the present embodiment includes the following steps:
[0023] Step one, preset a password table, each row in the password table points to a field name of sensitive data, including the field name before encryption and the field name after encryption, the field name after encryption includes a general field name and a digital code, and the field name before encryption and the general field name have the same part of speech and semantics.
[0024] As an example, the password table is set based on a specific project, as shown in Table 1, the pre-encryption field name includes a pre-encryption Chinese field name and a pre-encryption English field name, for example, the pre-encryption Chinese field name is "coupler", and the corresponding post-encryption Chinese field name is "equipment0001", "equipment" is a general field name, "0001" is a digital code, "coupler hot end", "coupler cold end", and "fourth iron" all correspond to the general field name "equipment", and are distinguished by digital codes, "fourth iron magnetic field strength", "fourth iron adjustment accuracy", and "fourth iron cooling method" all correspond to the general field name "attribute", and are distinguished by digital codes. The post-encryption field name includes a post-encryption Chinese field name corresponding to the pre-encryption Chinese field name, and a post-encryption English field name corresponding to the pre-encryption English field name, for example, the English field name of the coupler is "o_h_q", and the corresponding post-encryption English field name is "equipment0001". The core of the password table of the present application is that the word form and semantics of the pre-encryption and post-encryption field names remain unchanged, for example, "coupler" corresponds to "equipment0001", which does not affect the semantic understanding of the server to the encrypted prompt word. Further, the password table further includes a note column, which is supplementary information of the field name, as an example, the supplementary information includes associated fields, field types, units, or / and data storage lengths, and whether it is a required item, for example, in Table 1, the content of the note column of the fourth iron magnetic field strength is "associated field equipment0004, field type double, unit T, and required item".
[0025] Table 1 password table example
[0026]
[0027] It should be noted that Table 1 above is only an example, and the field names in the password table are set based on the needs of the project, such as common information that needs to be encrypted, such as company name, person name, etc., or other information that needs to be encrypted. When the person name needs to be encrypted, the pre-encryption person name and the post-encryption person name will be included in the password table. When the company name needs to be encrypted, the pre-encryption company name and the post-encryption company name will be included in the password table.
[0028] In step two, the AI coding tool client sends a prompt word request to the server, the processing end intercepts the prompt word request and forwards it to the server after encryption; the prompt word request includes the current code and user demand; the encryption process is based on the password table, and a state machine algorithm is used to find the field name of the matched sensitive data in the prompt word request, and the pre-encryption field name in the prompt word request is replaced by the post-encryption field name.
[0029] The user sends a prompt request to the server through the AI coding tool, which is an existing routine operation. The prompt request includes user requirements and the current code. The user requirements are written in Chinese text, and the main body of the current code is in English with Chinese and English comments. The user requirements can be an expression of the intention to modify the current code. The current code can be the code edited by the user or the existing code matched by the user through the software. The source of the current code is not limited in this embodiment.
[0030] The processing end can be a third-party software end, which performs operations such as information interception, encryption processing, and information forwarding, that is, intercepting the prompt request, encrypting the intercepted prompt, and forwarding the encrypted prompt request to the server. The operations of the processing end are invisible to the AI coding tool client. The user does not need to perform additional operations and is not aware of the specific operation process.
[0031] The encryption process is as follows: Based on the password table, the state machine algorithm is used to search for and match the field names of sensitive data in the prompt request, and the field names before encryption in the prompt request are replaced with the field names after encryption.
[0032] The state machine algorithm is described below:
[0033] Assume that the field names before encryption are coupler, hot end of coupler, and cold end of coupler. The processing process is as follows:
[0034] (1) Define the state set:
[0035] The initial state is State0: This is the initial state and no matching has started yet;
[0036] The state of matching "cou" is State1: It means that the character "cou" has been matched;
[0037] The state of matching "coupler" is State2: It means that the two characters "coupler" have been matched;
[0038] The state of matching "coupler" is State3: It means that "coupler" has been successfully matched;
[0039] The state of matching "coupler heat" is State4: It means that the four characters "coupler heat" have been matched;
[0040] The state of matching "hot end of coupler" is State5: It means that "hot end of coupler" has been matched.
[0041] The state of matching "coupler cold" is State6: It means that the four characters "coupler cold" have been matched;
[0042] Match the status of "cold end of coupler" as State 7): It means that the "cold end of coupler" has been matched.
[0043] (2) Set the state transition rules:
[0044] State 0 → Input "cou" → State 1;
[0045] State 1 → Input "pler" → State 2;
[0046] State 2 → Input "device" → State 3 (complete the matching of "coupler").
[0047] State 3 → Input "hot" → State 4, State 3 → Input "cold" → State 6;
[0048] State 4 → Input "end" → State 5;
[0049] State 6 → Input "end" → State 7.
[0050] (3) Trigger the field name replacement operation:
[0051] When the matched status is State 3, State 5, or State 7, trigger the field name replacement operation to replace the matched original string with the target word. In this embodiment, the specific process is as follows: when in State 3, replace "coupler" with "Device 0001" based on the password table; when in State 5, replace "hot end of coupler" with "Device 0002" based on the password table; when in State 7, replace "cold end of coupler" with "Device 0003" based on the password table.
[0052] The state machine algorithm gives priority to matching the longest, which meets the actual requirements; the state machine algorithm has high processing performance, with the time complexity of a single traversal being O(n), and it can use caching to store the characters in the matching to reduce the splicing overhead; the state machine algorithm has scalability and can support more replacement words by modifying the state table, such as adding State 8 - 9 to process "coupler interface", etc.
[0053] In the process of the server returning the response content to the AI coding tool client, the processing end intercepts the response content and forwards it to the AI coding tool client after decryption; the decryption process is to find and match the response content based on the encrypted field name through a simple regular expression and replace it with the encrypted field name.
[0054] The sensitive data encryption and decryption method in the large language model generation code provided in this embodiment allows for the setting of encrypted Chinese and English field names as needed during password table configuration. Therefore, the encryption and decryption process can handle both Chinese and English field names included in the user's requirements, improving efficiency and desensitization effectiveness. The password table is set based on specific projects, achieving complete desensitization of sensitive information. Furthermore, the field names before and after encryption have the same part of speech and semantics, thus avoiding intrusive modifications and ensuring the large language model server's semantic understanding of the encrypted prompts, thereby guaranteeing the quality of the returned response. Moreover, efficient encryption is achieved using a state machine algorithm, and efficient decryption is achieved using constraint rules. The entire processing is seamless for the AI encoding tool client, requiring no additional user intervention and not affecting the user experience.
[0055] To facilitate understanding of this invention, the following examples illustrate the method for encrypting and decrypting sensitive data in the code generated by a large language model, based on specific projects.
[0056] The password table preset in step one is shown in Table 1.
[0057] The current code in the prompt word request in step two is:
[0058]
[0059]
[0060] The user requirement in step two is to change the cooling method of the quadrupole iron to a single option, with the choices being natural cooling and water cooling.
[0061] The user requirement in step two, after being encrypted, is: Change device 0004 to a single selection, with the options being natural cooling and water cooling.
[0062] The current code in step two, after encryption, is as follows:
[0063]
[0064]
[0065] Step two also includes the processor identifying the encrypted field names that were replaced during the encryption process, forming a remarks information table with the encrypted field names and their corresponding remarks columns, and forwarding it to the server. The remarks information table can also be understood as deleting rows containing unused field names from the password table and hiding the original field names in the remaining rows. The remarks information table helps the large language model server to semantically understand the encrypted prompt word requests.
[0066] The contents of the remarks information table are as follows:
[0067]
[0068] The code of the response content returned by the server in step three is:
[0069]
[0070]
[0071] In step three, the processing end decrypts the response content based on the password table, and the decrypted code is:
[0072]
[0073]
[0074] The technical features of the above-described embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above-described embodiments are not described, but as long as the combinations of the technical features do not exist, they should be considered as within the scope of the present disclosure.
[0075] The above-described embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the present application. It should be pointed out that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.
Claims
1. A method for encrypting and decrypting sensitive data in code generated from a large language model, characterized in that, include: A pre-defined password table is provided. Each row in the password table points to a field name of sensitive data, including the field name before encryption and the field name after encryption. The field name after encryption includes a general field name and a numeric code. The field name before encryption and the general field name have the same part of speech and semantics. During the process of the AI coding tool client sending a prompt word request to the server, the processing end intercepts the prompt word request, encrypts it, and forwards it to the server; the prompt word request includes the current code and the user's requirements; The encryption process is as follows: based on the password table, a state machine algorithm is used to search for the field name that matches the sensitive data in the prompt word request, and the field name before encryption in the prompt word request is replaced with the field name after encryption; During the process of the server returning response content to the AI encoding tool client, the processing end intercepts the response content, decrypts it, and forwards it to the AI encoding tool client. The decryption process involves using a simple regular expression to search and match the response content based on the encrypted field names, and replacing them with the unencrypted field names.
2. The method for encrypting and decrypting sensitive data in the code generated by a large language model as described in claim 1, characterized in that, The field names before encryption include the Chinese field names before encryption and the English field names before encryption; The encrypted field names include the encrypted Chinese field names corresponding to the original Chinese field names, and the encrypted English field names corresponding to the original English field names.
3. The method for encrypting and decrypting sensitive data in the code generated by a large language model as described in claim 2, characterized in that, In the password table, if the Chinese field name before encryption is "device class", the corresponding general field name after encryption is "device". If the English field name before encryption is "device class", the corresponding general field name after encryption is "equipment". The numeric encoding is an M-bit value, where M is 1 to 6.
4. The method for encrypting and decrypting sensitive data in the large language model generated code as described in claim 2, characterized in that, In the password table, if the Chinese field name before encryption is attribute-type, the corresponding general field name after encryption is attribute; if the English field name before encryption is attribute-type, the corresponding general field name after encryption is property. The numeric encoding is an N-digit value, where N is 1 to 6.
5. The method for encrypting and decrypting sensitive data in the code generated by a large language model as described in claim 2, characterized in that, The process of setting up the password table is as follows: Based on the specific project, compile a list of Chinese field names for entities and attributes that need to be de-identified; define corresponding English field names uniformly; and define encryption rules, specifically defining general field names and numeric codes.
6. The method for encrypting and decrypting sensitive data in the large language model generation code as described in claim 1, characterized in that, The password table also includes a remarks column, which provides supplementary information about the field names. The supplementary information includes one or more of the following: associated field, field type, unit, data storage length, and whether it is a required field.
7. The method for encrypting and decrypting sensitive data in the code generated by a large language model as described in claim 6, characterized in that, When the password table includes a remarks column, when the processing end intercepts the prompt word request, encrypts it, and forwards it to the server, it also sends the remarks information table to the server at the same time; the remarks information table includes the encrypted field names replaced by the processing end during the encryption process and the content of the corresponding remarks column.