Computer data security management method and system

Abstract

The invention relates to the field of computer data security management, in particular to a computer data security management method and system. Comprising the steps of obtaining task related information and generating an access control strategy; when an access request for target data is intercepted, acquiring situation information such as visitor identity, role of the visitor in a current task and access purpose, generating an access decision based on the situation information and an access control strategy, and determining whether access is allowed or not and a required data processing mode; when access is allowed, processing the target data according to the access decision and returning a processing result; when the end of the life cycle of the task is detected, the access authorization related to the task is automatically revoked according to the state change of the task, and the subsequent access request based on the task is blocked. The problems of out-of-control access permission, sensitive information leakage, compliance risk and ghost permission of an existing data security management method in a multi-tenant and complex service scene are solved.

Description

Technical Field

[0001] This application relates to the field of computer data security management, and more specifically, to a computer data security management method and system. Background Technology

[0002] In multi-tenant environments using cloud computing and distributed storage, enterprises often provide isolated logical spaces for different departments or partners on the same infrastructure. Traditionally, permissions and data levels (such as public, internal, and confidential) are pre-defined based on departments and roles, which is generally usable for routine access within each department. However, the situation becomes immediately complicated when cross-departmental, ad-hoc collaborative projects involving external partners arise.

[0003] To support such projects, enterprises establish shared data zones on cloud platforms to centrally store heterogeneous data from multiple sources, including R&D code, raw user behavior data, and external algorithm models, with vastly different levels of sensitivity. In this case, simply granting all participants full access would result in external personnel having access to core code and ordinary employees having access to highly sensitive user data, severely violating the principle of least privilege and posing a high risk. On the other hand, switching to finely configured access control lists relies heavily on manual administrator intervention, with complex rules that change frequently, making it highly susceptible to overly broad or incorrect authorizations due to oversight or logical flaws.

[0004] Meanwhile, according to data protection regulations, user data used for model training must be strictly anonymized. Existing systems lack the ability to process data in real time based on visitor identity and purpose, relying instead on business personnel to clean and anonymize the data offline before uploading copies. This is not only labor-intensive and inefficient, but also makes it difficult to ensure consistent implementation of the anonymization strategy throughout the entire data flow, posing compliance risks.

[0005] After a project ends, all temporary authorizations should be revoked along with the project's lifecycle, especially external account permissions. However, current permission systems are mostly built up from repeated temporary, non-standardized manual configurations, lacking an automatic revocation mechanism tied to the task's lifecycle. Administrators are prone to forgetting or failing to thoroughly clean up these permissions, resulting in external accounts retaining some access paths long after the project ends, creating long-standing ghost permissions. If these accounts are compromised, it could lead to serious data breaches.

[0006] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0007] This application discloses a computer data security management method and system, which aims to solve the problems of uncontrolled access permissions, leakage of sensitive information, compliance risks, and ghost permissions in existing data security management methods under multi-tenant and complex business scenarios.

[0008] The technical solution of this application is as follows: In a first aspect, this application discloses a computer data security management method, comprising the following steps: Obtain task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories of target data that the task needs to access and their corresponding purposes. Based on task-related information, generate access control policies for making judgments based on real-time context; Intercept access requests for target data. When an access request is intercepted, obtain contextual information corresponding to the access request. The contextual information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of the access. Access decisions are generated based on contextual information and access control policies. The access decisions indicate whether to allow the access request to access the target data, and if access is allowed, how to process the target data. If the access decision indicates that access is permitted, the target data content is processed accordingly based on the access decision to obtain the processed data content, and the processed data content is returned to the access requester. When the end of a task's lifecycle is detected, access authorizations related to the task are automatically revoked based on changes in the task's lifecycle status, ensuring that subsequent data access requests related to the task are no longer authorized based on access control policies.

[0009] Secondly, this application also discloses a computer data security management system, comprising: The task information acquisition module is used to acquire task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories of target data that the task needs to access and their corresponding purposes. The policy generation module is used to generate access control policies based on task-related information, which are then used to make judgments based on real-time context. The data access control module is used to intercept access requests for target data. When an access request is intercepted, the context information corresponding to the access request is obtained. The context information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of access. The policy decision module is used to generate access decisions based on contextual information and access control policies. The access decision indicates whether to allow the access request to access the target data, and the data processing method to be performed on the target data when access is allowed. The data processing module is used to process the content of the target data according to the access decision when the access decision indicates that access is allowed, so as to obtain the processed data content and return the processed data content to the access requester. The authorization revocation module automatically revokes access authorizations related to a task when it detects the end of the task's lifecycle and based on changes in the task's lifecycle status, ensuring that subsequent data access requests related to the task are no longer authorized based on access control policies.

[0010] Beneficial effects: This application provides a computer data security management method. Through dynamic and context-aware access control and automatic authorization revocation mechanism, this application can significantly improve the security, flexibility and compliance of data access. It solves the problem that in multi-tenant and complex business scenarios, data permission management is difficult to adapt to business changes and is prone to data leakage. It realizes the transformation of data security management from static and passive to dynamic and proactive. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a computer data security management method provided in this application.

[0012] Figure 2 A flowchart of a computer data security management system provided in this application.

[0013] In the diagram: 1. Task information acquisition module; 2. Strategy generation module; 3. Data access control module; 4. Strategy decision-making module; 5. Data processing module; 6. Authorization revocation module. Detailed Implementation

[0014] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0015] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0016] In today's cloud computing and distributed storage environments, enterprise data management faces unprecedented complexity, especially when multiple tenants share infrastructure. Ensuring data isolation and secure sharing has become a pressing issue. Existing data security management methods lack the fine-grained and dynamic adjustment capabilities for data classification, sensitivity grading, and access permission settings. This makes it difficult to meet stringent security and compliance requirements in complex and ever-changing business scenarios, leading to security risks such as uncontrolled access permissions and leakage of sensitive information. Traditional access control systems based on static roles and preset rules are inadequate for handling scenarios such as cross-departmental collaboration, real-time processing during data flow, and timely revocation of permissions after project completion. They suffer from inefficiency, error-proneness, high compliance risks, and phantom permissions.

[0017] Reference Figure 1 In response, this application proposes a computer data security management method, comprising: S1000: Obtain task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories of target data that the task needs to access and their corresponding purposes. S2000: Generates access control policies based on task-related information for making judgments according to real-time context; S3000: Intercept access requests for target data. When an access request is intercepted, obtain context information corresponding to the access request. The context information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of the access. S4000: Generates access decisions based on contextual information and access control policies. The access decisions indicate whether to allow the access request to access the target data, and the data processing method to be performed on the target data when access is allowed. S5000: When the access decision indicates that access is permitted, the target data content is processed accordingly based on the access decision to obtain the processed data content, and the processed data content is returned to the access requester. S6000: Upon detecting the end of a task's lifecycle, automatically revokes access authorization related to the task based on changes in the task's lifecycle status, ensuring that subsequent data access requests related to the task are no longer authorized based on access control policies.

[0018] Task-related information refers to the necessary contextual data describing a specific business activity or project. For example, task-related information for a data analysis project may include: the project start and end times (task lifecycle); the analysts, engineers, and project managers involved in the project and their responsibilities (participants and their roles in the task); the data types of customer transaction records, product logs, etc., that the project needs to access, and their corresponding usage purposes (the category of target data and its corresponding usage purpose).

[0019] Access control policies are a set of rules generated based on task-related information. They are used to make real-time judgments when data is accessed, determining whether access is allowed and how the data should be processed.

[0020] Contextual information is the access context captured by the system in real time when an actual access request occurs, such as the identity of the user who initiated the access request, the user's specific responsibilities in the current task, and the specific intent of this access to data.

[0021] Access decisions are the result of a comprehensive judgment by the system based on contextual information and access control policies. They not only indicate whether access is allowed, but also indicate what data processing method should be used, such as desensitization, encryption, or aggregation.

[0022] Data processing methods refer to the transformation operations performed on raw data to protect data privacy or meet compliance requirements when access to target data is permitted. Examples include k-anonymization, differential privacy processing, or data aggregation.

[0023] In terms of specific processes, firstly, the system acquires task-related information as the basis for constructing access control policies. This information can be manually entered or automatically synchronized from the project management system and business process management system. When a new project starts, the project leader enters the project name, expected duration (task lifecycle), project members and their specific responsibilities (participants and their roles in the task), as well as the data types (such as customer personal information, sales data, R&D code) and access purposes (such as market analysis, model training, code review) required by the project in the management interface, and stores this information in a structured manner for use by the policy generation module. Secondly, the system generates access control policies based on task-related information to make judgments based on real-time context. This can be done using policy templates: the system pre-sets policy templates and automatically instantiates them based on the task purpose and target data combination. For example, when the task purpose is market analysis and the target data is customer personal information, the policy can stipulate that the visitor must be a market analyst and that the data must be anonymized during access. Alternatively, machine learning models can be used to automatically learn policy patterns based on historical tasks and access decision records, such as which data categories are allowed to be accessed and what kind of anonymization processing is required under specific task types and role combinations.

[0024] The system then intercepts access requests for the target data and obtains the corresponding contextual information. The visitor's identity can be provided by the user authentication system; the visitor's role in the current task can be queried from the task management system or user role management service; the purpose of access can be parsed from the request metadata or explicitly specified by the visitor when initiating the request. For example, when a data analyst accesses a client database through a data query tool, the system intercepts the request and obtains their username, their role in the current market analysis project (e.g., "Senior Analyst"), and the implicit purpose of access in the query statement (e.g., obtaining a list of clients who purchased specific products in the past year).

[0025] Based on contextual information and access control policies, the system generates access decisions. The system matches contextual information with policy rules. For example, a policy might stipulate that access to "customer personal information" is only permitted under the "market analyst" role, and the purpose of access is "market analysis," and that the "name" and "ID number" fields must be k-anonymized. When the contextual information meets this rule, the access decision indicates that access is permitted and specifies the appropriate data processing method; if no access is permitted under any of the rules, the decision indicates that access is denied.

[0026] When an access decision indicates that access is permitted, the system performs corresponding data processing on the target data content according to the access decision to obtain the processed data content, which is then returned to the requesting party. For example, when the decision requires K-anonymization, the system identifies sensitive identifiers in the data and generalizes or suppresses them, making each record indistinguishable from at least K-1 other records; when the decision requires data aggregation, the system summarizes the raw data, such as returning averages, sums, or counts, rather than detailed records. The processed data content is then sent to the requesting user or application.

[0027] When the system detects the end of a task's lifecycle, it automatically revokes access authorization associated with that task based on changes in the task's lifecycle status. Task completion can be detected through task completion notifications from the task management system, the expiration of a preset end time, or manual marking by the project manager as "completed." Upon detecting task completion, the system triggers an authorization revocation process, querying all access control policies and authorization records associated with the task, marking them as invalid or deleting them from the policy repository. This ensures that subsequent data access requests related to the task will no longer be authorized based on existing access control policies, thus preventing the creation of phantom permissions.

[0028] Compared to traditional statically configured access permissions, the method in this application generates context-aware access control policies based on task-related information and explicitly defines data processing methods in access decisions. During access, it automatically performs actions such as K-anonymization or data aggregation, ensuring consistent implementation of the principle of least privilege and data masking strategies while reducing the workload and compliance risks associated with manual data cleansing and masking. Furthermore, by automatically revoking access authorization at the end of the task's lifecycle, it effectively avoids the retention of temporary permissions, reduces the risk of long-term data leaks, and achieves refined, automated, and compliant management of data access in cloud computing and distributed storage environments.

[0029] In another embodiment of this application, S5000 is further proposed to include: S5100: When an access decision indicates that the content of the target data needs to be processed, identify the first characteristic of the requested target data, the first characteristic including at least sparsity, uniqueness and / or high-dimensionality features. S5200: Based on the first characteristic of the requested target data, determine whether the predetermined data processing method specified in the access decision will reduce the data usability of the target data for the intended use purpose. The predetermined data processing method includes K anonymization processing and / or data aggregation processing. S5300: When the judgment result is that the established data processing method will reduce the usability of the data, a data processing strategy adjustment request is generated, and based on the data processing strategy adjustment request, a decision is made to route the computing task request corresponding to the access request to the privacy computing sandbox. S5400: Routes the computation task request to the privacy computation sandbox, enabling the privacy computation sandbox to load the original data corresponding to the target data and execute the computation task in an isolated computing environment to obtain the computation result; S5500: Apply privacy enhancement techniques to the calculation results to obtain privacy-enhanced calculation results; S5600: Returns the privacy-enhanced computation results as processed data content to the requesting party.

[0030] Specifically, identifying the first characteristic of the requested target data refers to the process by which the system, upon receiving a data access request and determining that data processing is required, first analyzes the target data to identify its inherent data attributes. The first characteristic can be understood as the inherent properties of the data in terms of structure, distribution, and content. For example: sparsity refers to the characteristic that the proportion of valid information or non-zero values ​​in the data is relatively low; uniqueness refers to the characteristic that the data contains a large number of unique or nearly unique identifiers or records; high-dimensionality refers to the characteristic that the data contains a large number of attributes or variables, thus forming a complex feature space. Identifying the first characteristic provides a basis for selecting subsequent data processing methods.

[0031] Specifically, determining whether the predetermined data processing method specified in the access decision will reduce the usability of the target data for its intended use refers to the system evaluating the impact of pre-defined data processing methods, such as K-anonymization or data aggregation, on the usability of the target data, based on the identified primary characteristics. For example, for data with high uniqueness or sparsity, K-anonymization may lead to overgeneralization, thereby obscuring key information; for data with high-dimensional features, data aggregation may flatten important relationships. This determination aims to avoid impairing the analytical value of the target data for its intended use due to inappropriate data processing methods.

[0032] When the system determines that a given data processing method would reduce data usability, it generates a data processing strategy adjustment request. This request informs the data security management system or relevant decision-making entities that the current processing method is inapplicable and an alternative solution is needed. Based on this request, the system routes the corresponding computation task request to the privacy computing sandbox. The privacy computing sandbox is a platform that provides an isolated computing environment to perform computation tasks without directly exposing the raw data, thereby protecting data privacy while maximizing data usability.

[0033] After routing the computation task request to the privacy computation sandbox, the sandbox loads the original data corresponding to the target data and executes the computation task in an isolated computing environment. The original data is processed in a controlled manner only within the privacy computation sandbox and is not directly exposed to external systems or access requesters. This avoids the potential loss of practicality that traditional K-anonymization or data aggregation processing may cause in such data scenarios, while ensuring the privacy and security of the original data.

[0034] Applying privacy enhancement techniques to computation results refers to the process by which a privacy-enhancing computation sandbox further processes the computation results after completing the computation task and obtaining preliminary results, thus protecting their privacy. Privacy enhancement techniques can include differential privacy, secure multi-party computation, and result perturbations related to homomorphic encryption. The aim is to improve the strength of privacy protection without significantly affecting the usability of the computation results, preventing the reverse derivation of original sensitive information from the computation results.

[0035] Ultimately, the computational results processed using privacy enhancement techniques are returned to the requesting party as the processed data content. The data content obtained by the requesting party not only meets their intended use purpose but also receives full privacy protection throughout the processing, avoiding the problem of reduced data usability that may occur with traditional data processing methods under certain data characteristics.

[0036] The solution proposed in this application solves the problem that traditional data processing methods are prone to reduced data usability when faced with characteristics such as sparsity, uniqueness, and high dimensionality by introducing the identification of the first characteristic of the target data and dynamically judging the impact of the established data processing method on the data usability based on the first characteristic.

[0037] In another embodiment of this application, S5300 further includes: S5310: Analyze the second characteristics of the requested target data to determine the detailed reasons for the reduced usability of the data. The second characteristics include the distribution density of key features in the data, the degree of correlation between features, and the overall dimensional structure of the data. The detailed reasons include the degree of fuzziness of specific sparse features due to overgeneralization and / or the type of damage to high-dimensional correlation information caused by aggregation operations. S5320: Based on detailed reasons, combined with the visitor's role and purpose of access, evaluate multiple alternative data processing schemes and calculate the balance between privacy protection and data usability for each alternative data processing scheme; S5330: Encapsulate the detailed reasons, the evaluated alternative data processing solutions and their corresponding equilibrium points into a structured message, and use the structured message as a data processing strategy adjustment request.

[0038] Specifically, when generating a data processing strategy adjustment request, the second characteristic of the requested target data is first analyzed to determine the detailed reasons for the reduced data usability. The second characteristic is used to characterize the data's inherent structure and content at a deeper level, specifically including the distribution density of key features, the degree of correlation between features, and the overall dimensional structure of the data. Distribution density represents the frequency of occurrence of a specific value or feature in the dataset; correlation describes the statistical or semantic relationship between different features; and dimensional structure reflects how the data is organized in the feature space. Based on the analysis of the second characteristic, detailed reasons can be identified. For example, in K-anonymization, to meet anonymization requirements, sparse and high-risk features are over-generalized, leading to excessive blurring of specific sparse features and thus losing the required analytical precision. In data aggregation, merging multiple data points into an aggregated value may destroy the complex relationships that originally existed between high-dimensional features. Through the above analysis, the root cause of the reduced data usability can be accurately located, providing a basis for subsequent strategy adjustments.

[0039] Furthermore, based on detailed reasons and considering the visitor's role and purpose, various alternative data processing schemes are evaluated, and the balance between privacy protection and data usability is calculated for each scheme. Alternative data processing schemes refer to methods that differ from established data processing methods (such as K-anonymization and / or data aggregation) but achieve equal or higher privacy protection goals and perform better in terms of data usability. For example, when overgeneralization obscures sparse features, differential privacy techniques can be considered to protect individual privacy by injecting noise while preserving the overall statistical characteristics of the data as much as possible; or secure multi-party computation (SMPC) can be used to complete joint computation without exposing the original data. When evaluating alternatives, the visitor's role (such as a data scientist, auditor, or business analyst) and purpose (such as trend analysis, model training, or compliance audit) need to be comprehensively considered, as different roles and purposes have different requirements for data usability. The calculation of the balance point refers to the quantitative trade-off between the strength of privacy protection (e.g., through quantitative indicators such as privacy budget ε) and data usability (e.g., data analysis accuracy, model performance, or query result accuracy). This provides a basis for selecting the optimal solution, thereby forming a comparable and measurable decision-making foundation between privacy protection and data usability.

[0040] Finally, the detailed reasons, evaluated alternative data processing solutions, and their corresponding equilibrium points are encapsulated into a structured message, which serves as the data processing strategy adjustment request. The structured message can use predefined formats and fields (e.g., JSON or XML), including: a detailed description of the reasons, the names of each alternative data processing solution, parameter configurations, the expected privacy protection level, the expected data usability indicators, and the corresponding equilibrium point values. Organizing this information in a structured manner ensures that the data processing strategy adjustment request remains clear, complete, and accurate during transmission, facilitating parsing and processing by the recipient (e.g., the policy decision module and / or the privacy computing sandbox), thus providing sufficient basis for policy adjustments or routing decisions.

[0041] In some preferred embodiments, the following specific example illustrates the situation: Suppose a medical research institution needs access to a sensitive dataset containing patient gene sequences and rare disease diagnostic records to study the association between specific genes and diseases. Based on the access decision, the initially designated data processing method is K-anonymization to protect patient privacy. However, after performing K-anonymization, the system determines that this processing method reduces data usability: over-generalization obscures the specific gene sequence characteristics of rare disease patients, making it impossible for researchers to accurately identify and analyze these sparse but crucial data points. At this point, the proposed solution is triggered to generate a data processing strategy adjustment request. The system first analyzes the second characteristic of the target data, identifying that the distribution density of rare disease-related gene loci in the gene sequence data is extremely low, these gene loci are highly correlated with diagnostic records, and the entire dataset exhibits a typical high-dimensional structure. The detailed reason is derived: K-anonymization over-generalizes the sparse features with extremely low distribution density and high correlation, destroying the fine structure required for the research.

[0042] Subsequently, the system, considering the visitor's (medical researcher's) role and purpose (a study on the association between specific genes and diseases), evaluates various alternative data processing schemes, such as differential privacy schemes (injecting noise into gene sequence data to protect privacy while maintaining statistical correlation) and secure multi-party computation schemes (enabling research institutions and data owners to jointly calculate correlation indicators without sharing the original gene sequences). It also calculates the balance between privacy protection and data usability for each scheme (e.g., differential privacy schemes achieve approximately 90% accuracy in correlation analysis at ε=0.5, while secure multi-party computation maintains approximately 98% accuracy without reducing precision). Finally, the system encapsulates detailed reasons (e.g., overgeneralization of rare disease gene sequences by K-anonymization leading to obscuring key features), information on each alternative data processing scheme and its balance point (e.g., Scheme A: Differential privacy, ε=0.5, 90% accuracy; Scheme B: Secure multi-party computation, 98% accuracy) into a structured message and sends it as a data processing strategy adjustment request to the decision-making module. Based on this, the decision-making module can more intelligently decide whether to route computational task requests to the privacy computing sandbox, and which alternative data processing scheme to prioritize in the sandbox, thereby maximizing support for the medical research's need for high-quality, highly practical analytical results while strictly protecting patient privacy.

[0043] In another embodiment of this application, it is further proposed that after S5330, the following is included: S5331: Asymmetric encryption is used to encrypt structured messages using a pre-configured public key to obtain encrypted structured messages; S5332: Calculate the hash value based on the encrypted structured message, generate a digital signature on the hash value using the private key used to identify the sender of the structured message, and send the encrypted structured message and the digital signature as a data processing strategy adjustment request; S5333: When a data processing strategy adjustment request is received, the public key paired with the private key is used to verify the digital signature. If the verification is successful, the hash value is recalculated based on the encrypted structured message and compared with the hash value contained in the digital signature to confirm that the encrypted structured message has not been tampered with during transmission. S5334: Use the private key paired with the public key to decrypt the encrypted structured message to obtain the detailed reasons contained in the structured message, as well as alternative data processing schemes and their corresponding balance point information.

[0044] Specifically, a structured message is a data packet consisting of detailed reasons obtained from analysis, evaluated alternative data processing solutions, and corresponding balance point information, typically encapsulated in JSON, XML, or other structured data formats. Asymmetric encryption of structured messages involves using a pair of keys (public and private keys) for encryption and decryption, where the public key is used for encryption and the private key for decryption. When encrypting a structured message using a pre-configured public key, the recipient's public key is used, ensuring that only the recipient holding the corresponding private key can decrypt and read the message content, thus protecting the confidentiality of information contained in data processing strategy adjustment requests.

[0045] Furthermore, calculating the hash value based on the encrypted structured message refers to performing a hash operation on the encrypted data content to generate a fixed-length hash digest. This hash value serves as a fingerprint of the message content; any slight tampering will cause the hash value to change. Generating a digital signature on the hash value using the private key used to identify the sender of the structured message means that the sender uses their private key to encrypt the hash value, forming a digital signature to prove that the message was indeed sent by the sender and has not been tampered with after signing, thus providing message integrity and non-repudiation of the sender. The encrypted structured message and the digital signature are then encapsulated together as a data processing policy adjustment request and sent to the recipient.

[0046] When the receiver receives a data processing strategy adjustment request, it first verifies the digital signature using the public key paired with the sender's private key to confirm the legitimacy of the request source and the validity of the signature. If the digital signature verification passes, the receiver recalculates the hash value based on the received encrypted structured message and compares the recalculated hash value with the hash value contained in the digital signature. If they match, it further confirms that the encrypted structured message has not been tampered with during transmission, thus ensuring message integrity. Subsequently, the receiver decrypts the encrypted structured message using the private key paired with the public key used for encryption to obtain the detailed reasons, alternative data processing schemes, and their corresponding balance point information contained in the structured message.

[0047] The solution in this application introduces asymmetric encryption and digital signature mechanisms to simultaneously ensure confidentiality, integrity, and authenticity in the transmission link of data processing strategy adjustment requests: On the one hand, the structured message is encrypted using the recipient's public key, and only the recipient can decrypt it using their private key, preventing intermediate nodes from stealing sensitive policy information; on the other hand, the sender generates a digital signature on the hash value of the encrypted message using their private key, and the recipient verifies it using the sender's public key and recalculates the hash value for comparison, ensuring that the message has not been tampered with and was indeed sent by the declared sender.

[0048] In another embodiment of this application, a first characteristic for identifying the requested target data is further proposed, including: S5110: Subscribe to data ingestion services and data pattern change notifications to obtain real-time data ingestion, data structure definition updates, and metadata changes for key fields for each tenant; S5120: Based on real-time intake, data structure definition updates, and changes in metadata of key fields, detect fluctuations in data intake, structural adjustments to data patterns, or rate of change in the base of fields. When data intake fluctuations exceed preset fluctuation thresholds, structural adjustments to data patterns occur, and / or the rate of change in the base of a specific field exceeds a preset warning line, the data characteristic analysis process is triggered. S5130: In the data characteristic analysis process, sample data is extracted from the data storage, and sparsity is evaluated by calculating the proportion of zero or null values ​​in the sample data, uniqueness is evaluated by calculating the ratio of the cardinality of the key identifier field in the sample data to the total number of records, and high-dimensional features are evaluated by analyzing the average length and feature space distribution of the feature vectors in the sample data, so as to generate the data characteristic analysis results of the first characteristic. S5140: Generate and send a data characteristic description report containing the first characteristic based on the data characteristic analysis results, and update the locally maintained data characteristic cache; S5150: When a data access request is received, query the data feature cache to obtain the first feature corresponding to the target data of the current request; S5160: Determine whether the first characteristic is expired and / or significantly different from the current requested target data, and obtain the determination result; S5170: When the judgment result is that the first feature is expired and / or there is a significant difference from the current request target data, obtain the latest data feature identification result for the current request target data, and update the data feature cache based on the latest data feature identification result.

[0049] Specifically, subscribing to data ingestion services and data schema change notifications means that the system continuously monitors data flow events and data structure definition update events in the data platform to obtain real-time ingestion, data structure definition updates, and metadata changes of key fields. Real-time ingestion can be understood as the amount of data entering the system per unit of time, such as the number of new records or the data size per hour; data structure definition updates refer to the addition, deletion, and modification of data table fields, changes in data types, etc.; metadata changes of key fields can include field uniqueness constraints, index status, data distribution statistics, etc. This information provides the foundational data for the subsequent dynamic identification of the first characteristic.

[0050] Furthermore, detecting fluctuations in data intake, structural adjustments to the data pattern, or the rate of change in the cardinality of a field is achieved through analysis and comparison of the aforementioned real-time information. For example, a preset fluctuation threshold could be a percentage; a change in data intake exceeding 20% ​​within a short period is considered a fluctuation. Structural adjustments to the data pattern refer to significant changes in the data table structure, such as the addition or deletion of multiple key fields. The rate of change in the cardinality of a field is the rate at which the ratio of the number of unique values ​​in a field to the total number of records changes; a preset warning line is used to determine whether the degree of change requires attention. When fluctuations in data intake exceeding the preset fluctuation threshold, structural adjustments to the data pattern, and / or the rate of change in the cardinality of a specific field exceeding the preset warning line are detected, it can be considered that the intrinsic characteristics of the target data may have changed significantly, thereby triggering the data characteristic analysis process.

[0051] In the data characteristic analysis process, extracting sample data from the data store is to obtain sufficiently representative data for characteristic evaluation while controlling computational overhead. Sparsity evaluation is achieved by calculating the proportion of zero or null values; for example, if more than 80% of the records for a certain field are empty, it is considered to have high sparsity. Uniqueness evaluation is achieved by calculating the ratio of the cardinality of key identifier fields (such as user ID or order number) to the total number of records; the closer the ratio is to 1, the higher the uniqueness. High-dimensional feature evaluation is achieved by analyzing the average length of feature vectors and the distribution of the feature space. For example, dimensionality reduction techniques such as Principal Component Analysis (PCA) or t-SNE are used to observe the clustering and dispersion of data in the low-dimensional space to characterize the high-dimensional complexity of the feature space. These evaluation results collectively constitute the first characteristic of the target data.

[0052] Generating and sending a data characteristic description report containing the first characteristic based on the data characteristic analysis results, and updating the locally maintained data characteristic cache, is to structure and persist the analysis results, while providing quickly accessible characteristic information for subsequent access decisions. The data characteristic description report can use structured formats such as JSON or XML to record quantitative indicators of sparsity, uniqueness, and high-dimensional features; the locally maintained data characteristic cache serves as efficient query storage, saving the first characteristic within its validity period to improve the efficiency of subsequent request processing.

[0053] When a data access request is received, the data feature cache is queried to obtain the first feature corresponding to the target data of the current request. This is to avoid re-performing the complete data feature analysis for each request, thereby shortening the response time.

[0054] Determining whether the primary characteristic is expired and / or significantly different from the target data of the current request is crucial for ensuring the timeliness and accuracy of cached information. Expiration can be determined based on timestamps; for example, a primary characteristic in the cache is considered expired if it hasn't been updated for more than 24 hours. Determining significant differences involves comparing the cached data volume, field types, and key statistical indicators with the metadata or a small number of the latest samples of the target data in the current request. A significant difference is considered to exist when there are significant changes in data volume, additions / deletions of fields, or obvious shifts in key statistical features.

[0055] When the judgment result is that the first feature is outdated and / or significantly different from the target data of the current request, the system re-acquires the latest data feature identification result for the target data of the current request, and updates the data feature cache based on the result, so as to ensure that subsequent data processing decisions based on the first feature are based on the latest and most accurate feature information.

[0056] The solution proposed in this application introduces a dynamic data characteristic identification mechanism, which, compared to relying solely on static or periodically updated characteristic descriptions, can more timely reflect the changes in data status under real-time ingestion, structural adjustments, and the evolution of key field metadata.

[0057] In some preferred embodiments, a specific example is given below: Suppose a healthcare data platform needs to manage patients' electronic medical records, which contain sensitive diagnostic information, medication records, etc. When a research institution requests access to this data for epidemiological analysis, the system needs to identify the sparsity, uniqueness, and high-dimensionality of this data to determine how to handle privacy protection. First, the system subscribes to data ingestion services and data schema change notifications: when new patient data is entered into the system, or when the medical record template (data schema) is updated, the system receives a notification and continuously acquires real-time ingestion data such as the daily number of new medical records, updates to data structure definitions (e.g., adding an allergy history field), and metadata changes (e.g., changes in field cardinality) for key fields such as patient ID.

[0058] If the system detects that the number of newly added medical records in the past hour fluctuates beyond the preset fluctuation threshold (e.g., the number of new records suddenly increases from 100 per hour to 500), or if the medical record data pattern undergoes a structural adjustment (e.g., multiple fields related to gene sequences are added), the data characteristic analysis process will be triggered immediately. In this process, the system extracts 10,000 newly added medical records from the data storage within the past week as sample data and calculates the following: 1. Sparsity: For example, assessing the proportion of null values ​​in the family medical history field; if 85% of the records are null, the sparsity is considered high; 2. Uniqueness: For example, assessing the ratio of the cardinality of the patient ID field to the total number of records; if the ratio is close to 1, the patient ID has high uniqueness. Simultaneously, assessing the cardinality of the diagnosis coding field; if the number of unique values ​​is extremely high, it also indicates high uniqueness; 3. High-dimensional features: Analyzing the feature vectors composed of features such as age, gender, diagnosis, medication, and examination results in the medical records, calculating the average length of the feature vectors, and using dimensionality reduction techniques such as PCA to observe the feature space distribution; if the data points are sparsely distributed in the multidimensional space and there are complex nonlinear relationships between features, the system is considered to have significant high-dimensional features.

[0059] Based on the above analysis, the system generates a data characteristic description report, such as indicating that the family medical history field has high sparsity, the patient ID and diagnosis code have high uniqueness, and the overall data has high-dimensional characteristics. The system then uses this report to update the locally maintained data characteristic cache.

[0060] When the research institution subsequently initiates an access request, requesting fields such as patient ID, diagnosis code, and family medical history, the system first queries the data characteristic cache: if the first characteristic in the cache is recently generated and has not exceeded a preset time (e.g., 24 hours), and a quick comparison confirms that the current requested target data and the corresponding cached data have not changed significantly in terms of data volume, field set, and key statistical indicators, then the first characteristic in the cache is used directly; if it is found that the cached information has expired, or the requested dataset is an order of magnitude larger than the dataset at the time of cache analysis, or contains new key fields, then the system re-triggers the data characteristic identification process, obtains the latest first characteristic for the current requested target data, and updates the cache.

[0061] In another embodiment of this application, it is further proposed that when the fluctuation of data ingestion exceeds a preset fluctuation threshold, the data pattern undergoes structural adjustment, and / or the base change rate of a specific field exceeds a preset warning line, the steps to trigger the data characteristic analysis process include: S5121: Based on the tenant identifier, business scenario identifier, and data sensitivity level associated with the current request target data, obtain the corresponding threshold adjustment rule set from the preset policy configuration service; S5122: Based on the threshold adjustment rule set and the deviation of the historical data characteristic analysis results, adjust the preset fluctuation threshold and / or preset warning line to obtain the adjusted preset fluctuation threshold and / or adjusted preset warning line. S5123: When the fluctuation of data intake exceeds the adjusted preset fluctuation threshold and / or the base change rate of a specific field exceeds the adjusted preset warning line, and / or a structural adjustment of the data pattern is detected, the data characteristic analysis process is triggered.

[0062] Specifically, before triggering the data characteristic analysis process, the system first retrieves the corresponding threshold adjustment rule set from the preset strategy configuration service based on contextual information such as the tenant identifier, business scenario identifier, and data sensitivity level associated with the currently requested target data. The tenant identifier distinguishes different data owners or users, the business scenario identifier identifies the specific business environment in which the data exists (e.g., financial transactions, healthcare, user behavior analysis), and the data sensitivity level quantifies the potential risk of data leakage or misuse. These identifiers and levels together constitute a multi-dimensional description of the current data scenario, enabling the system to adjust preset fluctuation thresholds and preset warning lines in a targeted manner. The strategy configuration service can be understood as a component that centrally stores and manages various threshold adjustment strategies, providing configurable and scalable rules to adapt to the differentiated needs of different tenants and business scenarios.

[0063] Furthermore, after acquiring the threshold adjustment rule set, the system dynamically adjusts the preset fluctuation threshold and / or preset warning line based on this rule set and the deviation of historical data characteristic analysis results. The deviation of historical data characteristic analysis results refers to false alarms or missed alarms that occurred in the past when the original threshold was used to trigger data characteristic analysis in the current or similar context. For example, a certain preset threshold may have frequently triggered meaningless analyses in the past, or failed to identify changes in key data characteristics in a timely manner. Based on this, the system adaptively tightens or relaxes the preset fluctuation threshold and / or preset warning line, forming adjusted preset fluctuation thresholds and adjusted preset warning lines, making the triggering conditions more consistent with the current context and risk appetite.

[0064] Based on the above adjustments, the data characteristic analysis process will only be triggered when fluctuations in data intake exceed the adjusted preset fluctuation threshold and / or the base change rate of a specific field exceeds the adjusted preset warning line, and / or a structural adjustment to the data pattern is detected. In other words, the system will only initiate resource-intensive data characteristic analysis when data changes reach an effective level that matches the current tenant identifier, business scenario identifier, and data sensitivity level. This avoids unnecessary analysis while ensuring timely response and accurate identification of critical changes.

[0065] The solution proposed in this application addresses the lack of flexibility of traditional fixed thresholds in dynamic data environments by introducing a dynamic threshold adjustment mechanism based on context and historical performance.

[0066] In another embodiment of this application, a further step is proposed: in the data characteristic analysis process, sample data is extracted from the data storage, and sparsity is assessed by calculating the proportion of zero or null values ​​in the sample data, and uniqueness is assessed by calculating the ratio of the cardinality of the key identifier field in the sample data to the total number of records. The process also includes: S5131: Access multiple heterogeneous data sources through a unified data interface layer, and select a sample extraction adapter corresponding to the data source type based on the data source type after being accessed through the unified data interface layer. S5132: Identify key partitions and / or key time windows in data storage based on metadata information from the data source. Metadata information includes data table structure definitions, index information, partitioning strategies, and / or timestamp ranges. S5133: Adjust the sample extraction strategy based on the key partition and / or key time window, the corresponding data volume and data update frequency, and use the sample extraction adapter to extract sample data from the key partition and / or key time window to obtain sample data. S5134: Record the source identifier and extraction timestamp of the sample data. The source identifier includes the data source identifier and the location identifier in the data source. Perform sparsity, uniqueness and high-dimensional feature analysis on the sample data to generate the data characteristic analysis results of the first characteristic.

[0067] Specifically, the unified data interface layer can be understood as a middleware or service layer used to shield the differences between underlying heterogeneous data sources (such as relational databases, NoSQL databases, data lakes, file systems, etc.) and provide a unified data access interface for upper-layer applications. Through this abstract access, upper-layer data characteristic analysis modules do not need to concern themselves with the specific details of data storage technology; they only need to pull data from the unified interface, thereby simplifying system design and maintenance and providing a consistent data view for subsequent sample extraction and analysis.

[0068] The sample extraction adapter is a module customized for different data source types or data storage structures. For example, for relational databases, the sample extraction adapter can achieve random sampling or stratified sampling through SQL queries; for HDFS-based data lakes, the sample extraction adapter can utilize MapReduce or Spark to perform distributed sampling; for streaming data, the sample extraction adapter can employ sliding window or timestamp-based sampling strategies. By selecting the appropriate sample extraction adapter based on the data source type, the system can improve the efficiency and accuracy of sample extraction while maintaining performance.

[0069] In practical applications, the metadata information of a data source includes data table structure definitions, index information, partitioning strategies, and / or timestamp ranges. This metadata information is used to identify key partitions and / or key time windows in data storage. For example, for log data partitioned by time, the latest partition or the time window corresponding to the most recent period often contains the most active or relevant data; for user data partitioned by user ID, some partitions may cluster high-value or high-sensitivity users. By identifying key partitions and / or key time windows based on metadata information, the system can focus sample extraction on data subsets with high information density, active changes, or high business value, thereby improving sample representativeness.

[0070] Furthermore, based on the identified key partitions and / or key time windows, the corresponding data volume, and the data update frequency, the system can dynamically adjust the sample extraction strategy: for key partitions with large data volumes and high update frequencies, the sampling ratio or sampling frequency is appropriately increased; for regions with small data volumes and infrequent updates, the sampling ratio or sampling frequency is reduced. Through this adaptive sample extraction strategy, the system controls computational and I / O overhead while ensuring sample representativeness, avoiding resource waste or sample bias caused by fixed sampling strategies in large-scale, dynamic data scenarios.

[0071] In addition, the source identifier and extraction timestamp of the sample data are recorded. The source identifier includes the data source identifier and its location within the data source. This is to provide traceability for the sample data, facilitating subsequent data auditing, problem investigation, and verification of the validity of data characteristic analysis results. Through these records, it can be clearly identified which data source, table, or file the sample data came from, what query or partitioning conditions were used, and when it was extracted, thereby enhancing overall data governance and compliance.

[0072] In some preferred embodiments, the following specific example illustrates the situation: Suppose an enterprise uses multiple data storage systems: a PostgreSQL-based relational database for storing customer order information, a MongoDB-based NoSQL database for storing user behavior logs, and an HDFS-based data lake for storing historical transaction data. When it is necessary to identify the primary characteristics of target data accessed for a specific business task, such as identifying the sparsity, uniqueness, and high-dimensionality features of customer order data, the system first abstracts and accesses the above heterogeneous data sources through a unified data interface layer, identifies that the target data is located in the PostgreSQL database, and then selects the sample extraction adapter corresponding to the relational database.

[0073] Subsequently, based on the metadata information of the PostgreSQL database (including table structure definitions, index information, and timestamp fields used to record order times), the system identifies the order data of the most recent week as the key time window, as this time window usually corresponds to the latest business activities and has a high data update frequency. According to the data volume and update frequency within this key time window, the system dynamically adjusts the sample extraction strategy: if the order volume in the most recent week is very large and there are a large number of new records every day, the sampling ratio is increased or stratified sampling is used to ensure that the sample covers different order types and customer groups; then, using the sample extraction adapter, sample data within this key time window is extracted from the PostgreSQL database. During the extraction process, the system records the source identifier of the sample data (e.g., PostgreSQL connection information, order table name, and specific time range conditions) and the extraction timestamp, and performs sparsity, uniqueness, and high-dimensional feature analysis on the sample data. For example, sparsity is assessed based on the proportion of null values ​​in the discount code field, uniqueness is assessed based on the cardinality ratio of the customer ID field to the total number of records, and high-dimensional features are assessed based on the combination patterns of the product items included in the order. Finally, data feature analysis results containing the above first characteristic are generated, and the locally maintained data feature cache is updated. When a subsequent access request needs to access customer order data, the system can directly query the data feature cache to obtain the first feature of the target data, and based on this feature information, determine whether the established data processing method will reduce the usability of the data, and further determine whether the computing task request corresponding to the access request needs to be routed to the privacy computing sandbox.

[0074] In another embodiment of this application, the analysis of sparsity, uniqueness, and high-dimensional features of the sample data is further proposed, including: S5134-1: Obtain the privacy protection preference configuration and data usability requirement configuration corresponding to the current tenant; S5134-2: Adjust the sensitivity threshold for sparsity analysis based on privacy protection preferences and data usability requirements; S5134-3: Adjust the judgment criteria for uniqueness analysis according to privacy protection preferences and data usability requirements; S5134-4: Adjust the evaluation weights and / or clustering density of high-dimensional feature analysis according to privacy protection preferences and data usability requirements; S5134-5: Perform sparsity analysis, uniqueness analysis, and high-dimensional feature analysis on the sample data based on the adjusted sensitivity threshold of sparsity analysis, the judgment criteria of uniqueness analysis, and the evaluation weight and / or cluster density of high-dimensional feature analysis.

[0075] Specifically, before performing data characteristic analysis, the system retrieves the privacy protection preferences and data usability requirements configured by the tenant associated with the current data access request. The privacy protection preferences describe the tenant's specific requirements regarding the degree of data anonymization and tolerance for privacy breaches, such as the minimum requirement for the K value in K-anonymization and the upper limit of the differential privacy budget. The data usability requirements describe the tenant's specific requirements regarding data analysis accuracy, availability, and query response speed, such as the upper limit for data aggregation granularity and the allowable level of data distortion. These configurations are stored in structured data format and can be set and updated in the tenant management interface, providing a clear basis for subsequent parameter adjustments.

[0076] Furthermore, the system dynamically adjusts the sensitivity threshold for sparsity analysis based on the acquired privacy protection preference configuration and data usability requirement configuration. The sensitivity threshold for sparsity analysis is used to determine whether the proportion of zero or null values ​​in the data reaches a certain level, in order to identify the sparsity characteristics of the data. For example, when the privacy protection preference configuration requires a higher degree of anonymization, the sensitivity threshold for sparsity analysis can be increased, so that relatively less sparse data is also identified as sparse, thereby triggering stronger privacy protection measures; when the data usability requirement configuration emphasizes higher analytical accuracy, the sensitivity threshold can be decreased to avoid overgeneralization of the data.

[0077] Meanwhile, the criteria for uniqueness analysis have also been adjusted based on the above configuration. Uniqueness analysis identifies the unique characteristics of data by evaluating the ratio of the cardinality of the key identifier field to the total number of records. When the privacy protection preference configuration emphasizes reducing the risk of individual identification, the criteria for uniqueness analysis become more stringent, meaning that even a lower cardinality ratio is considered unique, thus prompting the system to take stronger de-identification measures. When the data utility requirement configuration places more emphasis on preserving data details, the criteria can be appropriately relaxed to retain more original information while adhering to compliance.

[0078] Furthermore, the evaluation weights and / or cluster density of high-dimensional feature analysis are adjusted accordingly. High-dimensional feature analysis evaluates the dimensionality of data through the average length of feature vectors and the distribution of the feature space. In scenarios with high privacy requirements, the evaluation weights of high-dimensional feature analysis can be increased, or the cluster density can be adjusted to make clustering more granular, thus more sensitively identifying potential re-identification risks. In scenarios with high data usability requirements, these parameters tend to retain more original structural information to support complex models and refined analysis.

[0079] Ultimately, based on the dynamically adjusted sensitivity threshold for sparsity analysis, the judgment criteria for uniqueness analysis, and the evaluation weights and / or clustering density for high-dimensional feature analysis, the system performs sparsity analysis, uniqueness analysis, and high-dimensional feature analysis on the sample data. This yields first characteristic analysis results that match the current tenant's needs, providing a more targeted basis for subsequent access control strategies and data processing methods.

[0080] The solution proposed in this application overcomes the limitations of traditional fixed-parameter data characteristic analysis in balancing privacy and practicality by introducing the acquisition and application of tenant's personalized privacy protection preference configuration and data usability requirement configuration.

[0081] In some preferred embodiments, the following specific example illustrates the situation: Suppose there are two different tenants, A and B, both using the computer data security management method described in this application to manage their data. Tenant A is a medical research institution whose data contains highly sensitive patient information, requiring extremely high privacy protection, while having relatively relaxed requirements for real-time data analysis and accuracy. In Tenant A's configuration, the privacy protection preference is set to high-intensity privacy protection, and the data usability requirement configuration allows for a certain degree of data generalization. After obtaining these configurations, the system will increase the sensitivity threshold of sparsity analysis, so that even a small number of null or zero values ​​can be identified as sparsity, thereby triggering more stringent anonymization processing; at the same time, it will tighten the judgment criteria for uniqueness analysis, ensuring that any features that may lead to individual identification are identified and processed, and the evaluation weight of high-dimensional feature analysis is also biased towards identifying potential association risks. Tenant B is a market analysis company whose data is mainly used for trend analysis and user behavior prediction, requiring high data usability and analytical accuracy, and having relatively flexible privacy protection requirements while meeting compliance requirements. In Tenant B's configuration, the privacy protection preference is set to medium-intensity privacy protection, and the data usability requirement configuration emphasizes the preservation of data details. After obtaining these configurations, the system lowers the sensitivity threshold for sparsity analysis to avoid over-processing non-critical sparse features; the criteria for uniqueness analysis are relatively lenient, retaining more details without violating regulatory requirements; and the evaluation weight for high-dimensional feature analysis focuses on preserving the correlation structure between features to support the construction of complex market models. Through the above differentiated configurations and dynamic parameter adjustments, the solution in this application can generate data characteristic analysis results tailored to the needs of tenant A and tenant B respectively, thereby guiding subsequent access control strategies and data processing methods, achieving an optimized balance between privacy protection and data usability in different scenarios.

[0082] In another embodiment of this application, S5134-2 further includes: S5134-21: Identify quantitative indicators regarding the degree of data anonymization in privacy protection preference configurations, and quantitative indicators regarding the accuracy of data analysis in data usability requirement configurations; S5134-22: When a conflict is detected between the quantitative indicators of data anonymization and the quantitative indicators of data analysis accuracy, the conflict resolution process is initiated: according to the preset priority rules, the quantitative indicators of data anonymization and the quantitative indicators of data analysis accuracy are sorted, weights are assigned to the privacy protection preference configuration and data usability requirement configuration according to the priority rules, and the sensitivity threshold of sparsity analysis is adjusted according to the weights.

[0083] Among these, quantitative indicators of data anonymization level are used to measure the degree to which individual identity information is hidden or obscured after data anonymization. Specific examples include, but are not limited to: the K value in K-anonymization, the L value in L-diversity, the T value in T-proximity, and the privacy budget ε value in differential privacy. Depending on the specific indicator definition, higher or lower values ​​generally correspond to a higher degree of anonymization and a lower risk of individual privacy leakage. Quantitative indicators of data analysis accuracy are used to measure the ability of data to provide accurate and effective results in a specific analytical task. Specific examples include, but are not limited to, the confidence interval width of statistical analysis results, the accuracy, recall, and F1 score of machine learning models on a specific task, and the error range of query results. Higher values ​​or smaller errors in these indicators generally mean better data usability and the ability to support more precise analysis and decision-making.

[0084] When a conflict is detected between the quantitative metrics for data anonymization and the quantitative metrics for data analysis accuracy, it indicates that the current configuration cannot simultaneously meet the requirements for high anonymization and high analytical accuracy. For example, to achieve extremely high K-anonymization, it may be necessary to overgeneralize or suppress the data, leading to the loss of fine-grained information and thus affecting analytical accuracy; conversely, to pursue extremely high analytical accuracy, it may be necessary to retain more original data features, thereby reducing the degree of anonymization and increasing the risk of privacy leakage. In this case, the system initiates a conflict resolution process to systematically handle the aforementioned contradictions.

[0085] In the conflict resolution process, the system first ranks the quantitative indicators of data anonymization and data analysis accuracy according to preset priority rules. These priority rules can be configured based on business scenarios, data sensitivity, legal and regulatory requirements, or user preferences. For example, when dealing with highly sensitive medical data, privacy protection can be prioritized over data usability; when analyzing non-sensitive public data, data usability can be given higher priority. The ranking results guide subsequent weight allocation.

[0086] Subsequently, the system assigns weights to privacy protection preference configurations and data usability requirement configurations according to priority rules, quantifying their importance in the current conflicting context. For example, when privacy protection has a higher priority, a higher weight (e.g., 0.7) can be assigned to the privacy protection preference configuration, while a lower weight (e.g., 0.3) can be assigned to the data usability requirement configuration. These weights directly affect the adjustment of the sensitivity threshold for sparsity analysis. Specifically, the system can use weighted averaging, decision tree-based threshold adjustment, or an optimization algorithm to solve for the optimal sensitivity threshold under given weights, achieving a balance between privacy protection strength and data analysis accuracy in the adjusted sparsity analysis sensitivity threshold: satisfying basic privacy protection requirements while maximizing the preservation of the data's practical value.

[0087] This application's solution, by clearly identifying quantitative indicators of privacy protection and data usability, enables the system to accurately determine whether a conflict exists between the two. When a conflict occurs, a conflict resolution process is initiated, and the indicators are sorted and weighted according to preset priority rules, thus forming a data-driven adjustment mechanism. This mechanism ensures that the sensitivity threshold of sparsity analysis is not simply a trade-off between privacy and usability, but rather a targeted optimization based on specific scenarios and strategies. This avoids excessively sacrificing one objective in pursuit of another, thereby achieving more refined and reasonable strategic decisions in complex data security management scenarios.

[0088] In some preferred embodiments, the application of the above mechanism is illustrated below using a financial scenario: Suppose a financial institution needs to perform sparsity analysis on customer transaction data to identify potential fraud patterns. Its privacy protection preferences require high anonymization of customer identity information, for example, setting the K value in K-anonymization to no less than 50 to ensure that any individual is difficult to identify. Simultaneously, its data usability requirements require the fraud detection model to have an accuracy of no less than 90% to effectively identify fraudulent behavior. In actual analysis, the system identifies that strictly enforcing K=50 anonymization will overgeneralize records containing rare transaction features, causing key sparse features to become blurred, and the accuracy of the fraud detection model to drop to 80%, conflicting with the 90% target. At this point, the system initiates a conflict resolution process. Based on preset priority rules (e.g., in this scenario, fraud detection effectiveness is highly correlated with customer asset security; under the premise of meeting basic privacy compliance, the weight of data usability can be appropriately increased), the system can set the weight of the privacy protection preferences configuration to 0.6, the weight of the data usability requirements configuration to 0.4, and adjust the sensitivity threshold of the sparsity analysis accordingly. For example, the system can allow the K value to be adjusted to 30 for specific rare fraud features, while superimposing slight perturbations of differential privacy to compensate for the privacy risks brought about by the reduction of the K value, so that the overall level of privacy protection still meets compliance requirements. On this basis, the fraud detection model can identify more subtle fraud patterns, improving the accuracy from 80% to close to or reaching the expected target (such as 88%), thereby achieving a better balance between privacy protection and data usability.

[0089] Reference Figure 2 The specific embodiments of this application also disclose a computer data security management system, including: Task information acquisition module 1 is used to acquire task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories of target data that the task needs to access and their corresponding purposes. Policy generation module 2 is used to generate access control policies based on task-related information for judgment according to real-time context; Data access control module 3 is used to intercept access requests for target data. When an access request is intercepted, the context information corresponding to the access request is obtained. The context information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of access. The policy decision module 4 is used to generate access decisions based on contextual information and access control policies. The access decision indicates whether to allow the access request to access the target data, and the data processing method to be performed on the target data when access is allowed. Data processing module 5 is used to perform corresponding data processing on the content of the target data according to the access decision when the access decision indicates that access is allowed, so as to obtain the processed data content and return the processed data content to the access requester. The authorization revocation module 6 automatically revokes access authorizations related to the task when it detects the end of the task's lifecycle and based on changes in the task's lifecycle status, so that subsequent data access requests related to the task will no longer be authorized to access based on the access control policy.

[0090] This application aims to provide a computer data security management system capable of dynamically adjusting data access control and processing strategies based on real-time context, thereby addressing the lack of granularity and dynamic adjustment capabilities in existing data security management technologies. The system acquires key information such as task lifecycle, participant roles, and data usage purposes through a task information acquisition module, and then uses this information to construct context-aware access control strategies through a policy generation module.

[0091] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A computer data security management method, characterized in that, include: Obtain task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories of target data that the task needs to access and their corresponding purposes. Based on the task-related information, an access control policy is generated for making judgments based on the real-time context. Access requests to the target data are intercepted. When an access request is intercepted, context information corresponding to the access request is obtained. The context information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of the access. An access decision is generated based on the context information and the access control policy. The access decision indicates whether the access request is allowed to access the target data, and the data processing method to be performed on the target data when access is allowed. If the access decision indicates that access is permitted, the content of the target data is processed accordingly based on the access decision to obtain the processed data content, and the processed data content is returned to the access requester. Upon detecting the end of the task's lifecycle, based on the change in the task's lifecycle state, the access authorization associated with the task is automatically revoked, so that subsequent data access requests related to the task will no longer be authorized to access based on the access control policy.

2. The computer data security management method according to claim 1, characterized in that, Based on the access decision, the target data content is processed accordingly to obtain processed data content, and the processed data content is returned to the access requester, including: When the access decision indicates that the content of the target data needs to be processed, a first characteristic of the requested target data is identified, the first characteristic including at least sparsity, uniqueness and / or high-dimensionality features; Based on the first characteristic of the requested target data, it is determined whether the predetermined data processing method specified in the access decision will reduce the data usability of the target data under the intended use purpose. The predetermined data processing method includes K anonymization processing and / or data aggregation processing. When the determination result is that the established data processing method will reduce the usability of the data, a data processing strategy adjustment request is generated, and based on the data processing strategy adjustment request, a decision is made to route the computing task request corresponding to the access request to the privacy computing sandbox. The computation task request is routed to the privacy computation sandbox, which loads the original data corresponding to the target data and executes the computation task in an isolated computing environment to obtain the computation result. Privacy enhancement techniques are applied to the calculation results to obtain privacy-enhanced calculation results; The privacy-enhanced calculation result is returned to the requesting party as the processed data content.

3. The computer data security management method according to claim 2, characterized in that, When the determination result indicates that the established data processing method will reduce the usability of the data, a data processing strategy adjustment request is generated, including: Analyze the second characteristics of the requested target data to determine the detailed reasons for the reduced usability of the data. The second characteristics include the distribution density of key features in the data, the degree of correlation between features, and the overall dimensional structure of the data. The detailed reasons include the degree of fuzziness of specific sparse features due to overgeneralization and / or the type of damage to high-dimensional correlation information caused by aggregation operations. Based on the detailed reasons stated above, and taking into account the visitor's role and the purpose of the visit, multiple alternative data processing schemes are evaluated, and the balance between privacy protection and data usability for each of the alternative data processing schemes is calculated. The detailed reasons, the evaluated alternative data processing solutions, and their corresponding balance point information are encapsulated into a structured message, and the structured message is used as the data processing strategy adjustment request.

4. The computer data security management method according to claim 3, characterized in that, The detailed reasons, the evaluated alternative data processing schemes, and their corresponding equilibrium point information are encapsulated into a structured message, and this structured message is then used as the data processing strategy adjustment request, including: The structured message is encrypted using an asymmetric encryption method, employing a pre-configured public key to obtain the encrypted structured message. Calculate a hash value based on the encrypted structured message, generate a digital signature on the hash value using a private key that identifies the sender of the structured message, and send the encrypted structured message and the digital signature as the data processing strategy adjustment request. When the data processing strategy adjustment request is received, the digital signature is verified using the public key paired with the private key. If the verification is successful, the hash value is recalculated based on the encrypted structured message and compared with the hash value contained in the digital signature to confirm that the encrypted structured message has not been tampered with during transmission. Furthermore, the encrypted structured message is decrypted using a private key paired with the public key to obtain the detailed reasons contained in the structured message, as well as the alternative data processing scheme and its corresponding balance point information.

5. The computer data security management method according to claim 2, characterized in that, The first characteristics that identify the requested target data include: Subscribe to data ingestion services and data schema change notifications to obtain real-time data ingestion, data structure definition updates, and metadata changes for key fields for each tenant; Based on the real-time intake, the data structure definition update, and the metadata changes of the key fields, the system detects fluctuations in data intake, structural adjustments to the data pattern, or changes in the base number of fields. When the data intake fluctuation exceeds a preset fluctuation threshold, structural adjustments to the data pattern occur, and / or the base number change rate of a specific field exceeds a preset warning line, the data characteristic analysis process is triggered. In the data characteristic analysis process, sample data is extracted from the data storage, and sparsity is evaluated by calculating the proportion of zero or null values ​​in the sample data. Uniqueness is evaluated by calculating the ratio of the cardinality of the key identifier field in the sample data to the total number of records. High-dimensional features are evaluated by analyzing the average length and feature space distribution of the feature vectors in the sample data, so as to generate the data characteristic analysis result of the first characteristic. Based on the data characteristic analysis results, generate and send a data characteristic description report containing the first characteristic, and update the locally maintained data characteristic cache; When a data access request is received, the data feature cache is queried to obtain the first feature corresponding to the target data of the current request; Determine whether the first characteristic is expired and / or significantly different from the currently requested target data, and obtain the determination result; When the determination result is that the first feature is expired and / or has a significant difference from the current target data, the latest data feature identification result for the current target data is obtained, and the data feature cache is updated based on the latest data feature identification result.

6. The computer data security management method according to claim 5, characterized in that, When fluctuations in the data intake exceed a preset fluctuation threshold, structural adjustments occur in the data pattern, and / or the rate of change of the base of a specific field exceeds a preset warning line, a data characteristic analysis process is triggered, including: Based on the tenant identifier, business scenario identifier, and data sensitivity level associated with the current request target data, obtain the corresponding threshold adjustment rule set from the preset policy configuration service; Based on the threshold adjustment rule set and the deviation of the historical data characteristic analysis results, the preset fluctuation threshold and / or the preset warning line are adjusted to obtain the adjusted preset fluctuation threshold and / or the adjusted preset warning line. The data characteristic analysis process is triggered when the fluctuation of data intake exceeds the adjusted preset fluctuation threshold and / or the base change rate of a specific field exceeds the adjusted preset warning line, and / or a structural adjustment of the data pattern is detected.

7. The computer data security management method according to claim 5, characterized in that, In the data characteristic analysis process, sample data is extracted from the data storage, and sparsity is assessed by calculating the proportion of zero or null values ​​in the sample data. Uniqueness is assessed by calculating the ratio of the cardinality of the key identifier field in the sample data to the total number of records. The process also includes: Multiple heterogeneous data sources are accessed in an abstract manner through a unified data interface layer. Based on the data source type after being accessed in an abstract manner through the unified data interface layer, a sample extraction adapter corresponding to the data source type is selected. Based on the metadata information of the data source, key partitions and / or key time windows in the data storage are identified. The metadata information includes data table structure definition, index information, partitioning strategy and / or timestamp range. Based on the key partitions and / or key time windows, the corresponding data volume, and the data update frequency, the sample extraction strategy is adjusted, and the sample extraction adapter is used to extract sample data from the key partitions and / or key time windows to obtain the sample data. Record the source identifier and extraction timestamp of the sample data. The source identifier includes the data source identifier and the location identifier in the data source. Perform sparsity, uniqueness and high-dimensional feature analysis on the sample data to generate the data feature analysis result of the first feature.

8. The computer data security management method according to claim 7, characterized in that, The analysis of sparsity, uniqueness, and high-dimensionality features of the sample data also includes: Retrieve the privacy protection preferences and data usability requirements configurations corresponding to the current tenant; Adjust the sensitivity threshold for sparsity analysis based on the privacy protection preference configuration and the data usability requirement configuration; Adjust the criteria for uniqueness analysis based on the privacy protection preference configuration and the data usability requirement configuration; Adjust the evaluation weights and / or clustering density of high-dimensional feature analysis based on the privacy protection preference configuration and the data usability requirement configuration; Based on the adjusted sensitivity threshold for sparsity analysis, the judgment criteria for uniqueness analysis, and the evaluation weights and / or clustering density for high-dimensional feature analysis, the sample data are subjected to sparsity analysis, uniqueness analysis, and high-dimensional feature analysis.

9. The computer data security management method according to claim 8, characterized in that, Based on the privacy protection preference configuration and the data usability requirement configuration, adjust the sensitivity threshold of sparsity analysis, including: Identify the quantitative indicators regarding the degree of data anonymization in the privacy protection preference configuration, and the quantitative indicators regarding the accuracy of data analysis in the data usability requirement configuration; When a conflict is detected between the quantitative indicators of the degree of data anonymization and the quantitative indicators of the accuracy of data analysis, a conflict resolution process is initiated: the quantitative indicators of the degree of data anonymization and the quantitative indicators of the accuracy of data analysis are sorted according to preset priority rules, weights are assigned to the privacy protection preference configuration and the data usability requirement configuration according to the priority rules, and the sensitivity threshold of the sparsity analysis is adjusted according to the weights.

10. A computer data security management system, characterized in that, include: The task information acquisition module is used to acquire task-related information, including the task's lifecycle, participants and their roles in the task, as well as the categories and corresponding purposes of the target data that the task needs to access. The policy generation module is used to generate access control policies based on the task-related information, which are used to make judgments according to the real-time context. The data access control module is used to intercept access requests for the target data. When the access request is intercepted, the module obtains context information corresponding to the access request. The context information includes at least the visitor's identity, the visitor's role in the current task, and the purpose of access. The policy decision module is used to generate an access decision based on the context information and the access control policy. The access decision indicates whether to allow the access request to access the target data, and the data processing method to be performed on the target data when access is allowed. The data processing module is used to perform corresponding data processing on the content of the target data according to the access decision when the access decision indicates that access is permitted, so as to obtain the processed data content, and return the processed data content to the access requester. The authorization revocation module, upon detecting the end of the task's lifecycle, automatically revokes the access authorization associated with the task based on changes in the task's lifecycle state, ensuring that subsequent data access requests related to the task are no longer authorized to access the data according to the access control policy.

Images