Security data retrieval and tracing method and device, equipment and medium

Abstract

The invention relates to the technical field of data security, can be applied to business scenes such as financial science and technology and medical health, and discloses a security data retrieval and tracing method, device and equipment and a medium. Inputting the structured semantic representation into a pluggable compliance plug-in chain, and executing access verification based on role attributes to obtain a verified structured semantic representation; constructing an executable query statement based on the structured semantic representation and the metadata atlas, obtaining an initial query result and completing statistical rationality verification; and scanning the initial query result by using a sensitive field detector and triggering desensitization strategy processing to generate a target data view. According to the method, a unified data query link is formed by fusing semantic analysis, access control, statistical verification, sensitive identification and desensitization processing, dynamic compliance management of data access is realized, the sensitive data protection capability is improved, and the traceability of a query result is ensured.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a secure data retrieval and tracing method, apparatus, device, and medium. Background Technology

[0002] In the fintech business, companies have accumulated massive amounts of structured and unstructured data, including basic customer information, policy and claims records, risk control indicators, and channel sales data. Current data query methods primarily rely on BI-based visualization tools or self-service analysis systems on data platforms. These tools, when processing natural language queries, often depend on templated rules or fixed data models, failing to deeply understand the specialized semantics and domain relationships within the financial and insurance context. For example, they struggle to correctly interpret policy payment methods, the meaning of risk factors, or the domain semantics of multi-table relationships. Furthermore, the data query process lacks a constraint mechanism linked to compliance policies. The system cannot automatically determine whether query fields involve privacy or involve unauthorized access based on the visitor's role, and it is difficult to perform dynamic validation before and after queries, potentially leading to compliance risks such as sensitive data leaks. After query results are generated, there is a lack of a systematic audit chain, failing to effectively record query intent, field access paths, and the execution status of compliance modules, making it difficult to meet the current financial regulatory requirements for interpretability and traceability of data use.

[0003] In the healthcare sector, medical institutions and health service platforms have accumulated vast amounts of medical records, treatment process logs, examination and imaging data, and health monitoring data. Faced with this massive amount of medical data, medical personnel typically rely on unified data platforms or visualization analysis tools for information retrieval. However, the natural language processing capabilities of such systems often remain at the keyword matching level, failing to accurately understand professional semantics such as medical terminology, disease relationships, and treatment pathways, and also unable to correlate and interpret data across departments and systems. Furthermore, healthcare data is highly sensitive, and existing systems have weak verification mechanisms for personnel permissions, data tags, and access purposes, lacking the ability to automatically identify sensitive fields and implement corresponding privacy protection policies during the query phase. After the query results are output, the system also lacks a mechanism to fully record query behavior, field calls, and permission judgments, making it difficult for medical institutions to fulfill their privacy protection responsibilities or conduct post-event audits. Summary of the Invention

[0004] The main objective of this invention is to provide a secure data retrieval and traceability method, apparatus, device, and storage medium, aiming to solve the technical problem that existing technologies cannot achieve the collaborative processing of deep domain semantic understanding and dynamic compliance verification throughout the entire natural language query process, thus making it difficult to ensure the security and traceability of data access.

[0005] To achieve the above objectives, the present invention provides a secure data retrieval and traceability method, comprising: Receive a natural language query instruction, and semantically fuse the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation; Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification based on the current visitor's role attributes, and output the verified structured semantic representation; Based on the verified structured semantic representation and metadata graph, construct an executable query statement adapted to the target database; The executable query statement is executed in the target database to obtain initial query results, and statistical reasonableness checks are performed on the initial query results. If the initial query result passes the statistical reasonableness check, the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plug-in chain; If sensitive data tags are detected, the desensitization strategy in the pluggable compliance plugin chain is invoked to process the initial query results to generate the target data view.

[0006] Furthermore, to achieve the above objectives, the present invention provides a secure data retrieval and traceability device, comprising: The semantic parsing and fusion module is used to receive natural language query instructions, and semantically fuse the natural language query instructions with domain knowledge in a preset knowledge base to obtain a structured semantic representation; The access verification and compliance control module is used to load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification according to the current visitor's role attributes, and output the verified structured semantic representation. The query construction and database adaptation module is used to construct an executable query statement adapted to the target database based on the verified structured semantic representation and metadata graph. The data execution and statistical verification module is used to execute the executable query statement in the target database to obtain initial query results, and to perform statistical reasonableness verification on the initial query results; The sensitive field scanning module is used to scan the initial query result using the sensitive field detector configured in the pluggable compliance plug-in chain if the initial query result passes the statistical reasonableness check. The data anonymization and view generation module is used to process the initial query results to generate a target data view by invoking the anonymization strategy in the pluggable compliance plugin chain if sensitive data tags are detected.

[0007] Furthermore, to achieve the above objectives, the present invention also provides a computer device, the computer device including a memory, a processor, and a secure data retrieval and tracing program stored in the memory and executable on the processor, wherein when the secure data retrieval and tracing program is executed by the processor, it implements the steps of the secure data retrieval and tracing method as described above.

[0008] Furthermore, to achieve the above objectives, the present invention also provides a non-volatile computer-readable storage medium storing a secure data retrieval and tracing program, wherein the secure data retrieval and tracing program, when executed by a processor, implements the steps of the secure data retrieval and tracing method as described above.

[0009] Beneficial Effects: This invention relates to the field of data security technology and can be applied to business scenarios such as fintech and healthcare. It discloses a secure data retrieval and traceability method, apparatus, device, and medium, comprising: receiving a natural language query command and generating a structured semantic representation by combining it with a knowledge base; inputting the structured semantic representation into a pluggable compliance plugin chain and performing access verification based on role attributes to obtain a verified structured semantic representation; constructing an executable query statement based on the structured semantic representation and metadata graph, obtaining initial query results and completing statistical reasonableness verification; scanning the initial query results using a sensitive field detector and triggering de-identification strategy processing to generate a target data view. This invention integrates semantic parsing, access control, statistical verification, sensitive identification, and de-identification processing to form a unified data query chain, achieving dynamic compliance governance of data access, improving sensitive data protection capabilities, and ensuring the security and traceability of query results. Attached Figure Description

[0010] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a schematic diagram of an application environment for a secure data retrieval and tracing method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating an embodiment of the secure data retrieval and tracing method of the present invention; Figure 3 This is a schematic diagram of the functional modules of a preferred embodiment of the secure data retrieval and traceability device of the present invention; Figure 4 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 5 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0011] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0012] The secure data retrieval and tracing method provided in this invention can be applied to, for example... Figure 1 In this application environment, the client communicates with the server via a network. The server can receive natural language query commands from the client and generate a structured semantic representation by combining it with a knowledge base. This structured semantic representation is then input into a pluggable compliance plugin chain, and access verification is performed based on role attributes to obtain a verified structured semantic representation. Based on this structured semantic representation and metadata graph, an executable query statement is constructed to obtain initial query results and complete statistical reasonableness verification. A sensitive field detector scans the initial query results and triggers a de-identification strategy to generate the target data view. This invention integrates semantic parsing, access control, statistical verification, sensitive data identification, and de-identification processing to form a unified data query chain, achieving dynamic compliance governance of data access, improving sensitive data protection capabilities, and ensuring the security and traceability of query results. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The following detailed description of specific embodiments further illustrates this invention.

[0013] Please see Figure 2 , Figure 2 This is a flowchart illustrating an embodiment of the secure data retrieval and tracing method provided by the present invention. It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0014] like Figure 2 As shown, the secure data retrieval and tracing method proposed in this invention includes the following steps: S10, Receive a natural language query instruction, and semantically fuse the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation; In this embodiment, the natural language query command originates from the user's text input and first undergoes text normalization processing, including character format standardization, punctuation regularization, word order reorganization, and synonym merging, to facilitate subsequent semantic parsing. Semantic parsing uses a language understanding model to identify intent phrases, business entities, attribute names, and constraints in the query content and encodes these language fragments into vectorized representations. The initial query vector is generated by combining intent expression vectors, entity vectors, and condition expression vectors, serving as input for the subsequent knowledge enhancement process.

[0015] The pre-defined knowledge base contains organized business concepts, entity relationships, and indicator explanations to fill in semantic gaps in query expressions. Through similarity matching or semantic retrieval, highly relevant knowledge fragments, including field meanings, relational logic, or business constraints, are extracted from the knowledge base. The search results are aggregated with the initial query vector using methods such as attention fusion, vector concatenation, or relation injection to ensure clear contextual constraints and business consistency in the query expression.

[0016] The fused representation is transformed into a structured form by the semantic decoding module, including entity sets, attribute sets, condition sets, and logical relationships. This structured semantic representation provides explicit and computable input for the database query generation stage and ensures that fuzzy semantics from natural language can be stably mapped into executable data access logic.

[0017] When parsing query text, a deep semantic encoding-based parser or a custom parsing model incorporating a domain dictionary can be used to enhance industry terminology recognition. When generating the initial query vector, a multi-head attention encoder or a domain-fine-tuned model can be selected depending on the scenario. In the knowledge retrieval stage, vector retrieval can be used to strengthen semantic matching, or tag-based rule retrieval can be used to enhance business consistency. In the semantic fusion stage, attention mechanisms can be used to adjust the weight distribution between query content and knowledge content, or graph structure mapping can be used to enhance entity relationship representation. In the structured semantic generation stage, the structural granularity can be adjusted according to business needs, making the output more adaptable to subsequent access control and query construction processes.

[0018] This embodiment enables natural language input to be accurately mapped to clear data access semantics through language parsing, knowledge supplementation, and structured expression conversion, thereby reducing query ambiguity and improving semantic consistency across business scenarios.

[0019] S20, Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification according to the current visitor's role attributes, and output the verified structured semantic representation; In this embodiment, the pluggable compliance plugin chain is a process-oriented structure composed of multiple independent compliance check units. Each unit defines triggering conditions, data tag constraints, and role permission requirements through a policy description file. The loading process retrieves a set of plugins matching the current visitor's identity configuration from the policy library and reads constraint content such as permission rules, field sensitivity levels, data usage restrictions, and approval requirements through the policy parsing module.

[0020] When inputting structured semantic representations into the plugin chain, entity names, field names, and conditional logic need to be transformed into a set of field references that the permission verification module can recognize. This set contains potential access fields and inferred derived fields, ensuring that subsequent verification covers all access targets and preventing permission bypassing due to omissions.

[0021] Attribute-based access verification performs a step-by-step comparison of field permissions based on the visitor's role attributes, including parameters such as role tags, data domain tags, field sensitivity levels, and operation types. The comparison process may involve field rewriting, tag inheritance, or condition constraint expansion to ensure that permission judgments fully cover the query semantics. During verification, if a field's sensitivity level exceeds the visitor's authorized scope, a marking mechanism is used to restrict or substitute access for that field, ensuring that the final structured semantic representation reflects the actual boundaries of access permissions.

[0022] The final stage integrates structured semantic representation with verification tags, including field authorization information, restricted field identifiers, and the set of accessible fields, providing stable and compliant semantic input for subsequent query construction and result processing.

[0023] Plugin chains can be dynamically combined via policy files or loaded on demand via database configuration. Role attribute parsing can employ attribute mapping based on user profiles or permission inheritance strategies based on access context. Permission comparison can be based on tag matching algorithms or path determination using sensitivity level relationships stored in a graph structure. Field permission marking can use additional tag structures or permission masks to automatically filter or replace inaccessible fields in subsequent stages.

[0024] When integrating verification results, different granular semantic structures can be generated according to application requirements. For example, a strict access field set can be generated for high-risk control queries, or an extended structure that retains more contextual information can be generated for intelligent recommendation query scenarios.

[0025] This embodiment dynamically loads compliance plugins and combines role attributes for access verification, enabling query semantics to complete permission filtering and risk isolation before entering the data access stage, thereby reducing potential unauthorized access and improving the overall security and audit consistency of data use.

[0026] S30, Based on the verified structured semantic representation and metadata graph, construct an executable query statement adapted to the target database; In this embodiment, the verified structured semantic representation is a query semantic structure that has undergone access permission verification, which includes entity names, field names, filtering conditions, logical relationships, and compliance restriction identifiers. This structure forms a semantic framework that can be used to construct database queries. It originates from the semantic extraction results after natural language parsing and integrates role attributes and field authorization information during the permission verification stage. Therefore, it has a restricted set of fields and accessible logical expressions.

[0027] Metadata graphs are structured collections of knowledge that record database table structures, field meanings, relationships between fields, and primary / foreign key chains. They can be organized based on graph data models or constructed based on relational mapping tables. They include elements such as table names, field names, field types, relationships between fields, and table-level statistics, used to support field location, table join identification, and path inference.

[0028] The construction of a metadata graph is based on a systematic analysis of the database architecture, business relationships between tables, and the meaning of fields. By extracting, organizing, and graphically modeling the internal structural and business semantic information of the database, it organizes scattered structural information into a unified knowledge carrier that can be used for query generation, path inference, and permission auditing. The construction process first requires connecting to the target data source and obtaining its metadata, including a list of tables, fields, field types, primary and foreign key constraints, index structure, and view definitions. This structural information is extracted in batches through a system dictionary or database metadata interface. The extracted table and field information is added to the graph as nodes, with tables forming table-level nodes and fields forming field-level nodes. To build table-level relationships, it is also necessary to identify foreign key constraints and logical connection rules in the database, mapping foreign key links to edges in the graph to characterize the reference relationships between tables. When weakly structured relationships exist in a database, such as implicit relationships formed by field names, field meanings, or business rules, these potential relationships can be identified through field semantic alignment mechanisms. For example, additional association edges can be constructed based on methods such as field name similarity, business dictionary mapping, or field value pattern analysis, making the graph more suitable for cross-table query generation.

[0029] Beyond structural information, metadata graphs typically include table-level and field-level semantic annotations, such as field meanings, business uses, data sensitivity attributes, data refresh cycles, and the scope of accessible roles. This information comes from business data dictionaries, modeling documents, or manual annotations, and can be extracted from data dictionary documents and mapped to table fields using a semantic parsing module. To enhance the graph's role in natural language processing, business domain knowledge structures can be incorporated into the metadata graph. For example, business entities such as insurance policies, customers, and claims events can be mapped to high-level semantic nodes in the graph, establishing a semantic-to-physical mapping relationship with the underlying table structure. This makes the path selection from query intent to graph structure more accurate. Through a unified graph storage structure, all nodes, edges, and their attributes are integrated into a searchable and reasonable knowledge network, making subsequent field location, table association path inference, and semantic mapping more stable and reliable.

[0030] To further enhance adaptability across different database systems, database type identifiers, function compatibility features, and field type compatibility strategies can be incorporated during the construction process, enabling the graph to possess both structural and database characteristic knowledge. In multi-source database scenarios, the graph can be split into multiple subgraphs and cross-source node mappings can be established for unified management, supporting cross-system query generation and compliant computation.

[0031] The process of constructing an executable query statement first requires parsing the set of query objects and the set of query conditions from the structured semantic representation. The set of query objects consists of entity or field mapping targets contained in the semantic representation, used to locate data tables and their fields. The set of query conditions contains filtering logic, value constraints, comparison relationships, and combination methods, which are derived from the conditional expressions in natural language queries.

[0032] To map a query object to a data table, the corresponding structural information needs to be retrieved using the metadata graph, including the table to which the field belongs, the table join method, and whether there are duplicate field names, cross-table references, or derived field requirements. When the query includes derived fields, the derivation rules or calculation sources need to be searched in the graph to determine the final field path.

[0033] Based on the set of query conditions, it is necessary to combine the field types and constraints in the graph to convert the condition expressions into a database-compatible format. For example, semantic conditions such as "greater than a certain value" are mapped to numerical comparison expressions, and time expressions are mapped to date function calls supported by the database.

[0034] When generating a query statement draft, it is necessary to identify the tables to be joined based on the tables to which the fields belong and determine the join path to avoid table access errors caused by isolated conditions. The draft includes the field selection section, the table source section, and the condition combination section, which is the initial structure of the executable statement.

[0035] After the sketch is generated, the statement structure needs to be adjusted through the syntax optimization module, including optimizing the table join order, eliminating redundant fields, adjusting the nesting of conditions, and handling field alias conflicts, so that it conforms to the syntax specifications of the target database.

[0036] After optimization, to ensure that the query can be executed in the target database, the compatibility verification module needs to check data types, function calls, reserved word conflicts, field rewriting rules, etc., and adjust the expression according to the check results to form the final executable query that is adapted to the target database.

[0037] This embodiment constructs database query statements by combining structured semantic representation with metadata graphs, enabling the query intent expressed in natural language to be accurately mapped to the actual database structure. This achieves a controllable, interpretable, and auditable query generation method, and significantly reduces the risk of execution failure caused by incorrect field references, incorrect table joins, or syntax incompatibility.

[0038] S40, execute the executable query statement in the target database to obtain initial query results, and perform statistical reasonableness verification on the initial query results; In this embodiment, executing an executable query statement requires combining the field names, filtering conditions, and aggregation expressions corresponding to the semantic structure into a query expression recognizable by the database. The parsing unit of the target database then generates an execution plan. During parsing, the database loads the corresponding data pages or column segments into runtime memory through type checking, index selection, and scan path decision-making, forming the initial query results. The initial query results are a collection of field values, record counts, and distribution structures. Performing statistical rationality checks on this data can identify issues such as numerical distribution shifts, inconsistent field types, and orders of magnitude anomalies. The checks are based on fundamental statistics such as mean, variance, median, and extreme value proportions, combined with the field roles in the query semantics to determine if there are any missing records. The statistics used in the checks are derived from direct calculations of the current query results or compared with distribution information maintained by the metadata graph to verify whether the query logically conforms to the expected semantics. After the statistical rationality check is completed, the verified data set is output, providing reliable input for subsequent data security processes.

[0039] When executing queries in row-oriented databases, index scanning can improve the loading speed of filter fields, while column vector calculations can be used in column-oriented database environments to accelerate the generation of statistics. In high-concurrency application scenarios, sampling statistics can be introduced to reduce the resource overhead of full calculations; in high-precision scenarios, full-field distribution analysis can be performed to ensure stable and reliable verification results. In environments that need to handle queries across time periods, sharded nodes can be used to generate local statistics in parallel and then aggregate them to adapt to different data layouts.

[0040] This embodiment adds statistical rationality checks after query execution, which can promptly identify inconsistencies in results caused by semantic mapping deviations, field configuration differences, or data source anomalies. This ensures that the output of natural language queries remains interpretable in terms of structure, distribution, and quantity, thereby improving data quality and enhancing the reliability of results during the query process.

[0041] S50, if the initial query result passes the statistical reasonableness check, then the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plug-in chain; In this embodiment, after the statistical reasonableness verification is completed, a sensitive field scan needs to be performed on the initial query results to identify content that may contain privacy attributes, identifying information, or business restriction fields. The sensitive field detector is an identification unit based on field tags, field naming conventions, field source records, or field value patterns. It maps the field names, field types, and field content in the initial query results to a preset sensitive field set through field-level traversal. Field-level traversal means identification on a field-by-field basis, including three types of checking logic: field title matching, field type comparison, and field value feature matching. Field title matching is derived from naming rules in the sensitive field tag library, such as field names related to user information, health characteristics, or identity identifiers; field type comparison determines whether the field belongs to a restricted type based on the field's structured annotation information; and field value feature matching determines whether the field contains feature strings that may reveal identity or privacy through regular expression feature matching or template matching. The sensitive field detector can operate as a separate module in a pluggable compliance plugin chain, receiving the initial query results through a unified interface and then outputting a result set carrying sensitive field tags. After the scan is complete, the field list can be bound to sensitive tags to provide an input basis for subsequent data governance processes.

[0042] In columnar storage systems, field sets can be scanned in batches using column vectors to improve matching efficiency; in row-based storage, field-level streaming scanning can be used to identify field value features row by row. In highly sensitive scenarios, a two-layer detection logic can be introduced, combining field name recognition with field content feature recognition. In scenarios requiring improved performance, rapid screening can be performed based solely on field tags or field naming rules. In environments with high multi-regional data governance requirements, strategic field tag configuration can be utilized to enhance adaptability to specific regional privacy requirements through regional tag mapping.

[0043] This embodiment introduces sensitive field scanning after statistical rationality verification, which can identify fields containing privacy attributes or restricted data in the query chain in a timely manner, preventing unprocessed data from directly entering the display stage. This makes natural language queries not only convenient but also privacy-protecting, and achieves risk control and enhanced access security for query results.

[0044] S60, if sensitive data tags are detected, the desensitization strategy in the pluggable compliance plug-in chain is invoked to process the initial query results to generate the target data view.

[0045] In this embodiment, after the sensitive field detector outputs sensitive field tags, corresponding de-identification strategies need to be selected based on these tags to perform field-level reprocessing on the initial query results. De-identification strategies are a set of processing rules built upon field attributes, compliance requirements, and data types, including various operation methods such as character replacement, range mapping, obfuscation, segment retention, and encoding conversion. Strategy selection depends on the mapping relationship between sensitive field tags and a preset strategy table; specific de-identification rules are determined by tags, field types, and data usage scope. Strategy loading is accomplished through a pluggable compliance plugin chain. The plugin chain encapsulates different de-identification rules in the form of modular units, making strategy mounting, replacement, and updating scalable. After the initial query results enter the de-identification processing flow, the fields to be processed are first extracted according to the field list, and then de-identification transformation is performed item by item according to the rules. For example, character replacement rules achieve masking by replacing explicit characters in the field, range mapping rules achieve a balance between usability and privacy by mapping numerical fields to range expressions, and obfuscation rules reduce identifiability by sacrificing precision. After field processing is complete, the anonymized fields are integrated with the unprocessed fields to form a data set with a consistent structure. Finally, the target data view is generated through format normalization, ensuring structural stability and security in the presentation and subsequent analysis.

[0046] When processing character fields, a masking and retention strategy can be used, retaining only the first or last few characters to improve usability while replacing the middle segments. For numeric fields, a range-based strategy can be employed, mapping precise values ​​to segmented data. For date fields, a blurring strategy can be used, reducing time precision to decrease recognizability. In scenarios requiring improved performance, a parallel field processing mode can be used, grouping fields by type and processing different field sets in parallel. In scenarios requiring enhanced compliance, finer-grained strategy plugins can be loaded to perform field context checks before field-level processing, enabling refined anonymization in more complex data structures. For cross-source data scenarios, a multi-plugin combination strategy can be applied, selecting different processing rules for fields from different sources based on their source labels.

[0047] This embodiment performs field-level desensitization processing after scanning sensitive fields, which can shield content that may expose personal attributes or restricted business information without destroying the data structure. This ensures that the initial query results have the necessary privacy protection capabilities while maintaining business availability, and ensures that the result display process and downstream systems operate within a security boundary.

[0048] In one embodiment, step S10 above includes: S101, receives natural language query commands; S102, perform semantic parsing on the natural language query command to identify the query intent and key entities; S103, Based on the query intent and key entities, generate an initial query vector; S104, Based on the initial query vector, retrieve relevant domain knowledge fragments from the preset knowledge base; S105, integrate the initial query vector with the domain knowledge fragment to achieve contextual alignment between query intent and domain knowledge, and generate an enhanced query vector; S106, The enhanced query vector is input into the generative model for semantic decoding to generate an intermediate semantic representation; S107, The intermediate semantic representation is processed into a structured semantic representation to obtain a structured semantic representation.

[0049] In this embodiment, the natural language query instruction is a text string passed by the user through a dialog interface, query input box, or API. This text may contain business requirements, constraints, time ranges, and target limitations, such as expressions like "last year," "high-claim customers," and "channel distribution." The system first receives the natural language query instruction, encodes the original text into an internal expression form, including character set unification, language detection, encoding format conversion, and abnormal character filtering. If necessary, it performs multiple rounds of concatenation, combining multiple queries from a continuous dialogue into a single complete query to ensure that subsequent semantic analysis can obtain complete contextual information.

[0050] Semantic parsing performs hierarchical analysis of the content of natural language queries, typically including word segmentation or sub-word segmentation, part-of-speech tagging, dependency relation identification, and syntactic structure analysis. It identifies query intent and key entities in the query through pre-trained language models or dedicated parsing networks. Query intent is an abstraction of the data analysis goals the user hopes to achieve, such as "statistics," "comparison," or "screening high-risk customer groups," obtained through analysis of predicate phrases and interrogative structures. Key entities are derived from domain vocabularies, entity recognition models, or domain dictionary matching, covering product names, customer categories, time ranges, and geographic tags. They are used to mark words directly related to the business object in the query and provide constraint signals for subsequent vector generation and retrieval processes.

[0051] After obtaining the query intent and key entities, the system converts the natural language query instruction into an initial query vector. The initial query vector is a numerical representation in a high-dimensional semantic space, obtained by encoding the text sequence through an encoding network. Attention structures, bidirectional encoding networks, or other semantic encoding structures can be used to map the word sequence to a fixed dimension or a set of vector representations. When generating the initial query vector, query intent markers and key entity labels are embedded as additional features into the input of the encoding network. For example, by adding intent identifier vectors or entity type embeddings to the input sequence, the system enhances the vector's ability to express domain semantics, enabling the same query to produce vector representations that reflect different meanings in different business domains.

[0052] The pre-built knowledge base is a collection of domain knowledge resources that is constructed in advance and continuously updated. It contains domain knowledge fragments, which can be structured triples, semi-structured summary fragments, annotated text fragments, or tagged explanatory texts, categorized according to different business themes in finance, insurance, and healthcare. Based on the initial query vector, the system retrieves relevant domain knowledge fragments from the pre-built knowledge base using a similarity retrieval mechanism. During the retrieval process, the initial query vector is compared with the pre-calculated knowledge fragment vectors to calculate similarity. A vector index structure is used to quickly select the closest set of domain knowledge fragments in a high-dimensional space. When necessary, results irrelevant to the target entity are filtered out by combining key entities, ensuring that the retrieved domain knowledge fragments remain relevant to the query intent and key entities.

[0053] After obtaining domain knowledge fragments relevant to the query, the system performs an integration operation, combining the initial query vector with the domain knowledge fragments. During integration, the system combines the initial query vector with the vector or text representation corresponding to each domain knowledge fragment, generating enhanced query vectors through mechanisms such as vector concatenation, weighted summation, and attention-weighted fusion. Context alignment is achieved by introducing alignment weights during the fusion process. These weights are determined by the degree of matching between the query intent, key entities, and each domain knowledge fragment, ensuring that the enhanced query vector retains the user's original expression while absorbing supplementary information related to business rules, terminology, and domain constraints. In this way, the enhanced query vector not only contains direct information from the user input but also references to domain knowledge, thus demonstrating stronger professional semantic capabilities in subsequent generation processes.

[0054] The enhanced query vector serves as input to the generative model and is transformed into an intermediate semantic representation during the semantic decoding stage. The generative model can employ a one-way decoding structure, an encoder-decoder structure, or a multi-layer decoding network to map the enhanced query vector into an intermediate representation suitable for logical reasoning and structured generation. This intermediate semantic representation can take the form of labeled sequences, slot-filling structures, or intermediate logical expressions, used to explicitly describe query objectives, filtering conditions, aggregation dimensions, and ranking constraints. During decoding, the generative model progressively generates semantic fragments based on the information in the enhanced query vector, incorporating domain constraints during the generation process to avoid generating expressions that contradict the domain knowledge base.

[0055] After the intermediate semantic representation is generated, the system performs structured processing to convert it into a structured semantic representation. The structured semantic representation is presented in the form of a structured data structure, such as a configuration object composed of multiple fields, which includes a set of query targets, a set of filtering conditions, grouping and aggregation descriptions, and sorting and pagination instructions. The structured processing involves extracting corresponding elements from the intermediate semantic representation, mapping the abstract expression to a predefined set of fields, and filling each field with parsed parameter values. For example, "customers with high claims in the past two years" is broken down into a time range field, an amount threshold field, and a customer category field, and these are explicitly recorded in the structured semantic representation. The final generated structured semantic representation provides a unified interface for subsequent access control and query generation, making the conversion of queries from natural language expressions to structured configurations reproducible and interpretable.

[0056] This embodiment transforms natural language query commands into structured semantic representations and introduces query intent recognition, key entity extraction, vector retrieval fusion, and generative semantic decoding during the transformation process. This allows for precise mapping of queries to a structured expression space while maintaining the user's natural language interaction experience. This enables subsequent access control and query construction processes to be handled based on clear semantic configurations, thereby improving the accuracy of natural language query understanding and reducing the risk of misuse caused by semantic ambiguity in complex business scenarios.

[0057] In one embodiment, step S20 above includes: S201, Dynamically load a pluggable compliance plugin chain corresponding to the role attributes of the current visitor from the compliance policy library. The pluggable compliance plugin chain contains a policy description file for at least one compliance plugin. The policy description file defines a verification policy based on role attributes and data tags. S202, parse the policy description file to obtain the attribute-based access control policy that matches the role attributes; S203, apply the attribute-based access control strategy to the structured semantic representation, and perform attribute-based access verification on the data fields in the structured semantic representation based on role attributes and data tags; S204, Based on the result of the attribute base access verification, mark the data fields in the structured semantic representation that have no access permissions; S205, integrate the tagging results with the structured semantic representation to generate a verified structured semantic representation.

[0058] In this embodiment, when loading the pluggable compliance plugin chain, the system first performs a search and matching process in the compliance policy library based on the current visitor's role attributes. Role attributes may include fields such as job category, organizational level, business line affiliation, channel type, and authorization level. These fields are matched against the index structure in the compliance policy library to obtain one or more plugin chain configuration records that meet the conditions. Each plugin chain configuration record points to a set of ordered compliance plugins and the path to the policy description file associated with these plugins. Based on this, the system constructs the pluggable compliance plugin chain actually enabled in the current session and completes the assembly and initialization of plugin instances, so that subsequent structured semantic representations can flow sequentially within the plugin chain.

[0059] The compliance policy library stores policy description files in a centralized format. These files provide access control rules in a machine-readable format. The policy description files contain matching relationships between elements such as role attributes, data tags, access action types, and environmental constraints. For example, different data visibility ranges are configured for different roles such as "channel sales," "actuary," and "claims review," and differentiated access policies are configured for data tags such as "highly sensitive" and "medium sensitive." When parsing the policy description files, the system constructs a policy decision tree or a set of rules, breaking down each rule into a condition part and a decision part. The condition part references role attributes and data tags, while the decision part provides results such as allowing access, denying access, or requiring further approval. This forms an attribute-based access control policy that can be executed at runtime.

[0060] Once the structured semantic representation enters the pluggable compliance plugin chain, it is sequentially processed by one or more compliance plugins within the chain. Each plugin receives the current structured semantic representation and the parsed attribute-based access control policy. Internally, it traverses the data field definitions in the structured semantic representation, reads the data tags bound to the fields (e.g., customer identification fields, contact information fields, health status fields, financial indicator fields), and inputs these tags along with the current visitor's role attributes into the policy matching engine. The attribute-based access control policy acts as a decision maker in the matching engine. By comparing role attributes with subject attributes in the rule conditions and comparing data tags with resource attributes in the rule conditions, it generates field-level access decision results. The decision results include at least two categories: allowed access and prohibited access. It can also be extended to more granular results such as allowing only aggregated display or only allowing de-identified display, providing a basis for subsequent processing.

[0061] After completing field-level access checks, the system marks the data fields in the structured semantic representation based on the attribute-based access verification results. The marking process can attach an access control tag set to each data field, containing information such as the access result type, violation reason code, and relevant policy rule number. Fields determined to have no access rights are marked with "Access Denied" or "Sensitive and Restricted," while fields determined to be accessible are marked with "Access Allowed." Subsequently, the system integrates these tags with the original structured semantic representation to form a new, verified structured semantic representation instance. In this instance, the business meaning of the fields themselves remains unchanged, but each field has a clear access control status, providing clear access boundaries for subsequent query construction, result verification, and anonymization processing. This tightly integrates the business semantics derived from natural language queries with the organization's internal compliance policies.

[0062] This embodiment introduces a pluggable compliance plugin chain after the structured semantic representation and performs attribute-based access verification around role attributes and data tags. This allows for a fine-grained access control determination before the natural language query is converted into the underlying query statement. The granularity of access control is refined to the field level, and the determination result is explicitly recorded in the form of a verified structured semantic representation. This achieves integrated constraints between query semantics and compliance policies, reduces the probability of unauthorized fields being included in the query scope, and provides a reliable premise for subsequent query construction, result scanning, and de-identification processing. Overall, it improves the compliance and security of the data self-service retrieval process.

[0063] In one embodiment, step S30 above includes: S301, parse the verified structured semantic representation and extract the query object set and query condition set; S302, Based on the set of query objects, retrieve the metadata graph that stores the data table structure and relationships, and obtain the corresponding data table structure information; S303, Based on the set of query conditions and the data table structure information, generate a query statement draft; S304, perform syntax optimization on the query statement draft to generate an initial query statement; S305, Verify the compatibility of the initial query statement with the target database; S306. Based on the compatibility verification results, adjust the initial query statement to generate an executable query statement adapted to the target database.

[0064] In this embodiment, when constructing an executable query statement based on the verified structured semantic representation and metadata graph, the structured semantic representation is first parsed. The structured semantic representation is generated by the preceding steps and contains query object information and condition expression information. The parsing process extracts the object portion of the representation into a query object set and the condition portion into a query condition set using a semantic node traversal method. The query object set typically contains abstract representations such as entity names, field identifiers, and business item tags, derived from the semantic structure resulting from the fusion of user natural language input and the knowledge base; the query condition set contains condition expressions such as filtering attributes, comparison relationships, numerical ranges, and business status values, used to limit the query scope.

[0065] After obtaining the set of query objects, a metadata graph needs to be retrieved based on this set. The metadata graph, as a structured data network carrier, integrates information such as table structure, field definitions, field types, primary and foreign key relationships, cross-table join paths, field labels, and data domain boundaries. The retrieval process uses entity identifiers in the query object set as search keys, matching table names, field names, business domain labels, and other index structures in the data model to return the corresponding table structure information. This table structure information includes not only a list of fields but also field constraints, their join relationships with other tables, path selections for query construction, and physical table or view names in different database environments, thus providing a complete structural basis for subsequent query construction.

[0066] When generating a query statement draft based on the query condition set and data table structure information, the semantic layer expression needs to be transformed into a syntactic expression that the database can recognize. During the construction process, the system maps query objects to corresponding data table fields, maps the filtering logic in the condition set to field-level comparison expressions, and selects appropriate association paths based on the primary and foreign key relationships provided by the metadata graph. The query statement draft exists in a form that is close to the SQL structure but does not yet fully conform to the target database dialect, and includes basic elements such as field mapping, table references, association key selection, and logical operator assembly.

[0067] After generating a draft query statement, it needs to be syntax-optimized to become the initial query statement. The syntax optimization process includes identifying and merging duplicate table references, selecting the optimal join strategy based on the shortest join path or field availability, logically rewriting combined conditions to reduce redundancy, mapping semantic-level aggregation requests to database-supported aggregation operators, adjusting field sort order, and eliminating invalid field references. The optimized initial query statement maintains a database-resolvable structure, but its compatibility with the current target database has not yet been confirmed.

[0068] To ensure that queries can be executed correctly in the target database, the initial query statement needs to be compatibility verified. Different databases differ in function implementation, type systems, join syntax, pagination methods, alias syntax, etc. Therefore, the compatibility verification process uses a syntax checker to detect whether the statement contains function calls not supported by the target database, incompatible type conversions, or keywords that do not conform to dialect specifications. At the same time, it compares the table names, index names, and field names with database-side metadata to ensure that they actually exist and are accessible in the current environment.

[0069] After compatibility verification is completed, the initial query statement is adjusted based on the verification results to generate an executable query statement. The adjustment process includes replacing incompatible functions with equivalent functions, modifying the join statement structure, adjusting identifier case, adding necessary namespace or database prefixes, adjusting the pagination structure according to the target database's rules, and rewriting logical expressions to a syntax form supported by the current database. The final executable query statement satisfies all syntactic and semantic constraints of the target database and can be directly submitted to the execution engine for execution, ensuring that the semantically fused query can be stably executed in the data environment.

[0070] This embodiment, by parsing structured semantic representations, retrieving metadata graphs, and generating query statements that have been syntactically optimized and meet the requirements of database dialects, can accurately map the query intent expressed in natural language into an executable structured query form for the target database. This makes the query construction process interpretable, consistent, and adaptable to different environments, thereby reducing query errors caused by semantic biases and improving the executability and stability of queries in different database environments.

[0071] In one embodiment, step S40 above includes: S401, Establish a connection session with the target database; S402, Execute the executable query statement in the target database through the connection session to obtain the original data set; S403, perform data sampling on the original data set to generate a verification sample set; S404, determine the statistical distribution characteristic value of the verification sample set; S405, compare and analyze the statistical distribution characteristic value with the preset reasonableness threshold; S406, Based on the comparative analysis results, a conclusion is generated regarding whether the statistical rationality verification has passed, the conclusion including the identification of abnormal data distribution.

[0072] In this embodiment, when executing an executable query statement in the target database, a connection session needs to be established first. A connection session can be understood as a stateful communication channel between the application and the target database, containing information such as network address, authentication credentials, session parameters, transaction isolation level, and timeout. The establishment process is typically completed by a database driver component. The driver component receives the database connection configuration, encapsulates parameters such as address, port, username, authentication password or token into a connection request, and completes a handshake and authentication with the database server, generating a reusable session object. When managed through a connection pool, idle sessions can also be reused from the connection pool, reducing connection establishment overhead and maintaining stable response capabilities in high-concurrency retrieval scenarios.

[0073] After the connection session is established, the executable query statement is actually executed in the target database, generating the raw data set. The executable query statement originates from the construction and compatibility verification in the previous stage and already meets the syntax and dialect requirements of the target database. The execution process involves the database engine parsing the statement, performing syntax analysis, execution plan generation, index selection, join order determination, and disk or memory data reading, and outputting the records that meet the conditions as a result set according to their field structure. The raw data set refers to the complete query result obtained after execution, typically existing in a row-column format. Rows represent records, and columns correspond to data fields, which may contain different types of data elements such as numeric fields, text fields, time fields, and category code fields, used for subsequent reasonableness judgment and sensitivity analysis.

[0074] To avoid high-cost analysis of the entire dataset and control the latency of statistical judgment, data sampling can be performed on the original dataset to generate a validation sample set. Data sampling is the process of selecting a representative subset from the complete results. Sampling strategies can employ random sampling, stratified sampling, time-window based sampling, or business-based grouping sampling. Random sampling selects a number of records by generating a pseudo-random sequence based on the record index; stratified sampling ensures that the proportion of each sample category is close to the population by stratifying by fields; and time-window sampling retains results from the most recent period, suitable for scenarios focusing on real-time behavior. The validation sample set reduces the amount of data while maintaining the original distribution characteristics, achieving a balance between resource consumption and analytical accuracy in subsequent statistical calculations.

[0075] After obtaining the validation sample set, it is necessary to determine the statistical distribution characteristics. Statistical distribution characteristics are quantitative indicators used to describe the distribution pattern of sample data, and can include mean, variance, standard deviation, median, quantiles, skewness, kurtosis, category proportion, missing rate, etc. In specific calculations, for numerical fields, the mean and variance can be calculated by iterating through sample records and accumulating sums or sums of squares; the median and quantiles can be calculated using sorting or selection algorithms. For categorical fields, the frequency of occurrence of each category can be counted and normalized to obtain the proportion distribution. For time fields, indicators such as time interval distribution and time period concentration can also be calculated. These characteristics provide a quantitative basis for judging whether the query results are consistent with historical patterns or business expectations.

[0076] A preset reasonableness threshold is used for comparative analysis with statistical distribution characteristic values. The reasonableness threshold can be derived from historical data distribution statistics, risk control rule bases, regulatory guidelines, or business configurations. When generating thresholds, interval conditions can be configured individually for each key field. For example, upper and lower limits can be set for the mean for the amount field, a lower limit for the sample size for the premium quantity, and an upper limit for the abnormal proportion for the category percentage. The comparative analysis process compares the statistical distribution characteristic values ​​of the verification sample set with the corresponding thresholds item by item. If there are situations such as the mean deviating from the interval, excessive variance, insufficient sample size, or a certain category percentage being much higher than historical levels, it can be marked as abnormal data distribution. To improve robustness, multi-indicator joint judgment can also be introduced, calculating the comprehensive deviation of multiple feature combinations, and then matching it with the threshold set.

[0077] After completing the comparative analysis, a conclusion on whether the statistical reasonableness check passed needs to be generated, including identifiers of abnormal data distributions. The conclusion can be presented in a structured format, providing both an overall judgment result (using Boolean fields or enumerated values ​​to indicate whether the current query result passed the statistical reasonableness check) and a list of anomaly identifiers, clearly identifying which fields and distribution indicators are abnormal, and the corresponding deviation types, such as insufficient sample size, abnormal concentration, or imbalanced proportions. When generating the conclusion, each abnormal record can be appended with field names, indicator names, actual values, threshold ranges, and deviation directions to facilitate decision-making by subsequent sensitive field detection or compliance modules. If the overall judgment is "failed," the conclusion can be returned to the upstream process, blocking subsequent sensitive detection and de-identification processes; if the judgment is "passed," the conclusion is used as a marker, along with the initial query results, for subsequent sensitive field scanning and view generation.

[0078] This embodiment adds a quantitative verification layer to the natural language-driven data access process by establishing connection session management after executing an executable query statement, sampling and generating a verification sample set from the query results, comparing and analyzing statistical distribution feature values ​​with preset reasonableness thresholds, and outputting statistical reasonableness verification conclusions containing abnormal data distribution identifiers. This enables potential abnormal queries or result deviations to be detected and intercepted in advance, thereby reducing the risks caused by erroneous query semantics, data skew, or malicious requests, improving the reliability and security of subsequent sensitive field detection and desensitization processing, and ensuring that the data view obtained by the user is more in line with business expectations and regulatory requirements in terms of content distribution.

[0079] In one embodiment, step S50 above includes: S501, Load the sensitive field detector from the pluggable compliance plug-in chain; S502, Obtain the predefined sensitive data pattern strategy set from the sensitive field detector; S503, Traverse the sequence of data fields in the initial query result; S504, perform pattern matching between each data field in the data field sequence and the sensitive data pattern strategy set; S505, record the successfully matched sensitive data fields and the sensitive data tags corresponding to the sensitive data fields; S506 generates a sensitive field scan report containing all successfully matched sensitive data fields and their corresponding sensitive data tags.

[0080] In this embodiment, after the initial query results pass the statistical reasonableness check, the system enters the sensitive information identification stage. The triggering condition establishes a pre-constraint: only when the result distribution is determined to be statistically reasonable will a more refined scan of sensitive fields be performed on the initial query results. This avoids continuing compliance processing for obviously abnormal or distorted results, reducing resource consumption and lowering the risk of misjudgment. The initial query results here refer to the structured result set returned by the target database, typically in tabular form, containing multiple rows of records and multiple columns of data fields, and serve as the direct input for subsequent scanning operations.

[0081] The pluggable compliance plugin chain serves as the carrier of sensitive field detection capabilities. Various compliance plugins are registered within the chain, each encapsulating a specific type of compliance capability, such as sensitive field detection, de-identification policy execution, and access audit generation. Pluggable means that plugins can be enabled, disabled, or replaced through the configuration center or policy library without modifying the main control logic code, allowing for dynamic adjustments to the combination of compliance capabilities to meet the compliance requirements of different organizations and at different times. When a sensitive field scan is triggered, the control component, based on the currently effective compliance policy, locates the sensitive field detector with sensitive data identification capabilities from the plugin chain and loads it. The loading process can utilize mechanisms such as reflection, service discovery, or remote configuration synchronization to inject the detector's execution entry point, parameter template, and version information into the runtime environment, forming a directly invoked detection component instance.

[0082] The sensitive field detector internally maintains a set of sensitive data pattern strategies to characterize the representation of different types of sensitive information in the data. This set can include various types of rules and models, such as structured pattern rules for phone numbers, ID numbers, and bank card numbers, implemented using regular expressions or length checks and checksum calculations; textual semantic pattern rules for personal health descriptions, disease names, and policyholder identity attributes, implemented using keyword sets, extended thesaurus of synonyms, or classification model parameters; and sensitive fields defined by the institution, such as internal risk scores and actuarial parameters, bound to business definitions through field tags. After loading, the sensitive field detector reads the strategy set from the configuration store or strategy library and parses the rule content into a data structure suitable for high-performance matching, such as pre-compiled regular expressions, prefix trees, or vectorized expressions, so that it can quickly match when scanning the initial query results.

[0083] The data field sequence represents the set of fields and their values ​​that need to be scanned in the initial query results. When constructing the data field sequence, the result set can be traversed row by row, extracting fields from each row that are displayed or potentially leaked. Field names, field paths (used in multi-table joins or nested structures), field values, data types, and table information are combined into field entries and arranged sequentially into a sequence. For long text fields, segmentation or truncation can be performed before generating the sequence to control the length of a single match and avoid excessive resource consumption. After sequence construction is complete, the sensitive field detector traverses the data field sequence line by line, matching the value of each data field against a set of sensitive data pattern strategies. The matching process can perform precise pattern matching, such as character patterns, length patterns, and checksum patterns, or fuzzy pattern matching, such as keyword phrase matching based on similarity thresholds or sensitivity probability determination based on classification model output. For numerical fields, the value range, scale, and label definition can be combined to determine whether they belong to sensitive scoring or quota information.

[0084] A data field is considered sensitive when it matches at least one rule or model output from the sensitive data pattern policy set. The system records successfully matched sensitive data fields and associates them with sensitive data tags. Sensitive data tags are used to mark sensitive categories and levels, and can include tag codes, sensitive types (e.g., personal identity attributes, health status, financial credit parameters), compliance basis numbers, and processing requirement levels. During the recording process, a structured record entry can be generated for each sensitive data field. This entry includes field identification information, the matched pattern identifier, the match score or confidence level, and a set of sensitive data tags for subsequent de-identification processing and audit trails. If the same field matches multiple sensitive types, all tags can be retained in the record for the policy engine to select the most stringent processing path.

[0085] A sensitive field scan report is generated after a full scan is completed, summarizing all sensitive matching results during the scan process. The report can be presented in a structured format, including associated query identifiers, the number of rows and fields in the initial query results, scan start and end times, the version information of the sensitive field detector used in the scan, and a list of sensitive data fields. The sensitive data field list is aggregated by field name or field path, listing the sensitive data tags and matching rules for each sensitive data field. The report can also include statistical indicators, such as the percentage of sensitive fields and the number of fields grouped by sensitivity type, facilitating decision-making by compliance personnel or subsequent modules. The scan report can be written to audit storage or directly passed as input to the data masking process. During masking, the sensitive data fields listed in the report are used to locate the data units that need to be transformed, thus achieving a close connection between the scanning process and subsequent compliance processing.

[0086] This embodiment, after the initial query results pass statistical reasonableness verification, loads a sensitive field detector based on a pluggable compliance plug-in chain. It then uses a set of sensitive data pattern strategies to perform systematic pattern matching on the data field sequence constructed from the initial query results. Successfully matched sensitive data fields and their sensitive data tags are recorded, and a sensitive field scanning report is generated. This allows for structured sensitive information identification of the result set generated by natural language queries without relying on manual review. It accurately marks personal privacy information, health-related information, and financially sensitive parameters hidden in field values ​​before data output, providing complete input for subsequent de-identification processing and audit records. This significantly reduces the probability of sensitive information leakage during the query process and improves compliance governance capabilities and interpretability in a data self-service retrieval environment.

[0087] In one embodiment, step S60 above includes: S601, Load the desensitization strategy corresponding to the scanned sensitive data tags from the pluggable compliant plug-in chain; S602, parse the desensitization strategy and obtain the field-level desensitization processing strategy; S603, Identify the sensitive data fields in the initial query results that carry the sensitive data tag; S604, the data fields in the initial query results are distinguished into sensitive data fields and non-sensitive data fields; S605, according to the field-level desensitization processing strategy, perform corresponding desensitization conversion operations on the sensitive data field to generate the desensitized data field; S606, Integrate the desensitized data fields with the non-sensitive data fields to generate an intermediate data view; S607, The intermediate data view is formatted to generate the target data view.

[0088] In this embodiment, once the sensitive field scan results have identified sensitive data tags, the system begins the de-identification process. The scanned sensitive data tags are used to establish a trigger condition, allowing subsequent processing to proceed within a clearly defined data-level risk context. The tags themselves are classification symbols for sensitive information, typically containing the sensitivity type and sensitivity level, indicating the appropriate processing method for that field. The presence of tags allows subsequent processing to select different de-identification intensities based on different tags, thereby supporting differentiated data protection strategies.

[0089] Loading and scanning the de-identification policies corresponding to sensitive data tags is the entry point operation in the entire processing chain. The pluggable compliance plugin chain maintains multiple de-identification policies, each defined by a policy description file containing de-identification rules, processing requirements, field type limitations, and version information. The loading process retrieves the policy set from the plugin chain, identifies the de-identification policy to be enabled based on the mapping relationship between sensitive data tags and policy description files, and synchronizes the policy content to the current processing context. After loading, the policy becomes an executable entity, providing the rule foundation for subsequent field-level processing.

[0090] The parsing step of the de-identification strategy is used to convert the rule content in the strategy description file into directly executable field-level de-identification processing strategies. During parsing, the structured rules in the strategy are extracted, such as character retention length, mask symbol types, replacement ranges, hash parameters, and numerical generalization intervals, and converted into executable expressions for de-identification of specific fields. The parsing process also handles the differences between different field types; for example, masks are used for text fields, interval generalization is used for numeric fields, and hashing is used for identifier fields, forming a complete processing chain from matching rules to operation rules.

[0091] Identifying sensitive data fields carrying sensitive data tags in the initial query results involves aligning the list of sensitive fields in the scan report with each field in the initial query results to pinpoint the specific data units that need to be processed. The identification process typically uses field names, field paths, or data lineage indicators to match the sensitive data fields generated during the detection phase precisely to their locations in the initial query results. After identification, the system builds a list of sensitive data fields in memory, providing explicit input for subsequent target field processing.

[0092] The initial query results are categorized into sensitive and non-sensitive data fields to ensure that the data masking process does not mistakenly process fields that do not require handling. This categorization process relies on the results of the identification step; by performing a set difference operation on the field sets, fields not marked as sensitive are moved to the non-sensitive data field set. Non-sensitive data fields remain unchanged throughout the entire processing flow to ensure that the data value is not affected.

[0093] Sensitive data fields are anonymized according to field-level anonymization strategies. This involves performing specific transformations on fields already marked as sensitive. Anonymization operations include various forms, such as character masking, range generalization, random transformation, and hash mapping. During execution, the system selects the corresponding rule from the strategy based on the field type and sensitive data label, and applies the rule to the value of the sensitive data field. For example, if the field value is a string in the form of an ID number, partial retention and partial masking can be performed; if the field value is monetary data, range generalization can be performed; if the field value is health description text, keyword replacement or partial deletion can be performed. The output of the anonymization operation is the anonymized data fields, where each field retains its original structure but its value has been changed.

[0094] The anonymized data fields are integrated with the non-sensitive data fields to restore the structured form of the initial query results. The integration process re-merges the two sets according to the original field order, placing the anonymized fields in their original positions to ensure the data structure is consistent with the initial result. This integration operation guarantees that the structured output is not destroyed, allowing subsequent data display and system interfaces to directly use the processed results.

[0095] Formatting is used to transform an intermediate data view into a target data view that meets usage requirements. Formatting operations may include rearranging field order, standardizing data types, correcting encoding, and aligning row and column structures, ensuring that the integrated data view can be correctly recognized by front-end display components, export modules, or data transfer interfaces. After formatting, the target data view is generated and delivered as the final output to the query initiator.

[0096] Furthermore, the system collects query process data, including natural language query commands, structured semantic representations, executable query statements, and target data views. Its core objective is to form a query chain with semantic consistency and execution traceability. Natural language query commands originate from user input, carrying semantic intent and contextual clues. Structured semantic representations are generated by the semantic interpretation module based on a semantic parsing model, containing standardized query intents, field mapping relationships, constraints, and reasoning paths, used to drive query statement generation. Executable query statements contain SQL structures, field names, table names, filtering conditions, and join logic, directly used to access the data source. The target data view is generated through a compliance plugin chain, containing anonymized and transformed field content.

[0097] The data collection operation is implemented using a unified data record structure, pushing the data from the aforementioned query process into a single audit entity. The record structure includes fixed fields, such as the original instruction text, semantic structure, query statement text, execution timestamp, execution context, data view hash, plugin chain version information, and a summary of the data masking strategy. The data collection module executes in an event-triggered manner; once the target data view is generated during the query phase, the collection logic is automatically triggered synchronously to ensure that the recorded content fully covers all intermediate components from user semantic input to data output.

[0098] To ensure the non-repudiation and integrity of audit records, the system performs salted hash signature processing on the structured record. The hashing process uses a stable hash function to serialize the complete record structure and generate a fixed-length hash value. The salting process enhances the hash's collision resistance by using a pseudo-random value generated from a secure random source, preventing hash repetition due to fixed inputs. The generated hash value is written into the record structure for subsequent verification that the record has not been altered.

[0099] The generated audit records are appended to an immutable log chain. The log chain uses a chained structure, with each record containing a hash reference to the previous record, enabling chained verification. Write operations use a sequential write mode, disallowing overwriting or deletion. The record storage area can employ a blockchain-style structure, a WAL (write-ahead log) structure, or an append-only storage area with sequential pointers, as long as external entities cannot insert, delete, or rewrite any records. The log chain can simultaneously maintain a main chain and a verification chain. The verification chain is used to periodically perform full-chain consistency checks to ensure that historical records have not been modified.

[0100] This embodiment loads the corresponding desensitization strategy after scanning sensitive data tags, performs field-level desensitization transformation on sensitive data fields in the initial query results, and keeps non-sensitive data fields unchanged. After structured integration and formatting, the target data view is generated. This allows for precise differentiated protection of sensitive information in a data self-service query environment, achieving the principle of minimum usable exposure at the field level, and providing a controllable output format for different types of sensitive information. This significantly improves the compliance, security, and transparency of the data access process while maintaining the data availability required for business analysis.

[0101] In one embodiment, a secure data retrieval and tracing device is provided, which corresponds one-to-one with the secure data retrieval and tracing methods described in the above embodiments. (Refer to...) Figure 3 , Figure 3 This is a schematic diagram of the functional modules of a preferred embodiment of the secure data retrieval and traceability device of the present invention. The modules include: semantic parsing and fusion module 10, access verification and compliance control module 20, query construction and database adaptation module 30, data execution and statistical verification module 40, sensitive field scanning module 50, and data desensitization and view generation module 60. Detailed descriptions of each functional module are as follows: The semantic parsing and fusion module 10 is used to receive natural language query instructions, and semantically fuse the natural language query instructions with domain knowledge in a preset knowledge base to obtain a structured semantic representation; The access verification and compliance control module 20 is used to load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification according to the current visitor's role attributes, and output the verified structured semantic representation. The query construction and database adaptation module 30 is used to construct an executable query statement adapted to the target database based on the verified structured semantic representation and metadata graph. The data execution and statistical verification module 40 is used to execute the executable query statement in the target database to obtain the initial query results, and to perform statistical reasonableness verification on the initial query results; Sensitive field scanning module 50 is used to scan the initial query result using the sensitive field detector configured in the pluggable compliance plug-in chain if the initial query result passes the statistical reasonableness check. The data desensitization and view generation module 60 is used to process the initial query results to generate a target data view by calling the desensitization strategy in the pluggable compliance plugin chain if sensitive data tags are scanned.

[0102] In one embodiment, the semantic parsing and fusion module 10 is specifically used for: Receive natural language query commands; The natural language query command is semantically parsed to identify the query intent and key entities; Based on the query intent and key entities, an initial query vector is generated; Based on the initial query vector, relevant domain knowledge fragments are retrieved from the preset knowledge base; The initial query vector is integrated with the domain knowledge fragment to align the query intent with the context of the domain knowledge, thereby generating an enhanced query vector; The enhanced query vector is input into the generative model for semantic decoding to generate an intermediate semantic representation. The intermediate semantic representation is then processed into a structured semantic representation to obtain a structured semantic representation.

[0103] In one embodiment, the access verification and compliance control module 20 is specifically used for: Dynamically load a pluggable compliance plugin chain corresponding to the role attributes of the current visitor from the compliance policy library. The pluggable compliance plugin chain contains a policy description file for at least one compliance plugin. The policy description file defines a verification policy based on role attributes and data tags. Parse the policy description file to obtain the attribute-based access control policy that matches the role attributes; The attribute-based access control strategy is applied to the structured semantic representation, and attribute-based access verification is performed on the data fields in the structured semantic representation based on role attributes and data tags; Based on the results of attribute base access verification, data fields in the structured semantic representation that have no access permissions are marked; Integrate the tagging results with the structured semantic representation to generate a validated structured semantic representation.

[0104] In one embodiment, the query construction and database adaptation module 30 is specifically used for: Parse the verified structured semantic representation to extract the set of query objects and the set of query conditions; Based on the set of query objects, retrieve the metadata graph that stores the data table structure and relationships, and obtain the corresponding data table structure information; Based on the set of query conditions and the data table structure information, a query statement draft is generated; The query statement draft is then syntactically optimized to generate the initial query statement; Verify the compatibility of the initial query statement with the target database; Based on the compatibility verification results, the initial query statement is adjusted to generate an executable query statement adapted to the target database.

[0105] In one embodiment, the data execution and statistical verification module 40 is specifically used for: Establish a connection session with the target database; The executable query statement is executed in the target database through the connection session to obtain the original data set; Data sampling is performed on the original data set to generate a verification sample set; Determine the statistical distribution characteristics of the verification sample set; The statistical distribution characteristic values ​​are compared and analyzed with a preset reasonableness threshold; Based on the comparative analysis results, a conclusion is generated regarding whether the statistical rationality check has passed, and the conclusion includes the identification of abnormal data distribution.

[0106] In one embodiment, the sensitive field scanning module 50 is specifically used for: Load the sensitive field detector from the pluggable compliance plug-in chain; Obtain the predefined sensitive data pattern strategy set from the sensitive field detector; Iterate through the sequence of data fields in the initial query result; Perform pattern matching between each data field in the data field sequence and the sensitive data pattern strategy set; Record the successfully matched sensitive data fields and the corresponding sensitive data tags for those fields; Generate a sensitive field scan report containing all successfully matched sensitive data fields and their corresponding sensitive data tags.

[0107] In one embodiment, the data anonymization and view generation module 60 is specifically used for: Load the desensitization strategy corresponding to the scanned sensitive data tags from the pluggable compliance plug-in chain; The desensitization strategy is analyzed to obtain the field-level desensitization processing strategy; Identify sensitive data fields in the initial query results that carry the sensitive data tag; The data fields in the initial query results are categorized into sensitive data fields and non-sensitive data fields; According to the field-level desensitization processing strategy, the corresponding desensitization conversion operation is performed on the sensitive data field to generate the desensitized data field; The anonymized data fields are integrated with the non-sensitive data fields to generate an intermediate data view; The intermediate data view is formatted to generate the target data view.

[0108] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides determination and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a secure data retrieval and traceability method on the server side.

[0109] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides determination and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements client-side functions or steps of a secure data retrieval and traceability method.

[0110] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Receive a natural language query instruction, and semantically fuse the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation; Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification based on the current visitor's role attributes, and output the verified structured semantic representation; Based on the verified structured semantic representation and metadata graph, construct an executable query statement adapted to the target database; The executable query statement is executed in the target database to obtain initial query results, and statistical reasonableness checks are performed on the initial query results. If the initial query result passes the statistical reasonableness check, the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plug-in chain; If sensitive data tags are detected, the desensitization strategy in the pluggable compliance plugin chain is invoked to process the initial query results to generate the target data view.

[0111] In one embodiment, a non-volatile computer-readable storage medium is provided, which may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, it performs the following steps: Receive a natural language query instruction, and semantically fuse the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation; Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification based on the current visitor's role attributes, and output the verified structured semantic representation; Based on the verified structured semantic representation and metadata graph, construct an executable query statement adapted to the target database; The executable query statement is executed in the target database to obtain initial query results, and statistical reasonableness checks are performed on the initial query results. If the initial query result passes the statistical reasonableness check, the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plug-in chain; If sensitive data tags are detected, the desensitization strategy in the pluggable compliance plugin chain is invoked to process the initial query results to generate the target data view.

[0112] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0113] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0114] It should be noted that if any software tools or components not belonging to this company appear in the embodiments of this application, they are merely illustrative examples and do not represent actual use. The embodiments described above are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

[0115] The user personal information involved in this application embodiment is all authorized (knowing and consenting) by the relevant parties or fully authorized by all parties, and the executing entity can obtain it through various open, legal and compliant means. The collection, storage, use, processing, transmission, provision and disclosure of the information, data and signals involved all comply with the relevant laws and regulations of the relevant countries and regions, and do not violate public order and good morals.

Claims

1. A method for secure data retrieval and traceability, characterized in that, Includes the following steps: Receive a natural language query instruction, and semantically fuse the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation; Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification based on the current visitor's role attributes, and output the verified structured semantic representation; Based on the verified structured semantic representation and metadata graph, construct an executable query statement adapted to the target database; The executable query statement is executed in the target database to obtain initial query results, and statistical reasonableness checks are performed on the initial query results. If the initial query result passes the statistical reasonableness check, the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plug-in chain; If sensitive data tags are detected, the desensitization strategy in the pluggable compliance plugin chain is invoked to process the initial query results to generate the target data view.

2. The secure data retrieval and traceability method as described in claim 1, characterized in that, Receiving a natural language query instruction, semantically fusing the natural language query instruction with domain knowledge in a preset knowledge base to obtain a structured semantic representation, including: Receive natural language query commands; The natural language query command is semantically parsed to identify the query intent and key entities; Based on the query intent and key entities, an initial query vector is generated; Based on the initial query vector, relevant domain knowledge fragments are retrieved from the preset knowledge base; The initial query vector is integrated with the domain knowledge fragment to align the query intent with the context of the domain knowledge, thereby generating an enhanced query vector; The enhanced query vector is input into the generative model for semantic decoding to generate an intermediate semantic representation. The intermediate semantic representation is then processed into a structured semantic representation to obtain a structured semantic representation.

3. The secure data retrieval and traceability method as described in claim 1, characterized in that, Load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification based on the current visitor's role attributes, and output the verified structured semantic representation, including: Dynamically load a pluggable compliance plugin chain corresponding to the role attributes of the current visitor from the compliance policy library. The pluggable compliance plugin chain contains a policy description file for at least one compliance plugin, and the policy description file defines a verification policy based on role attributes and data tags. Parse the policy description file to obtain the attribute-based access control policy that matches the role attributes; The attribute-based access control strategy is applied to the structured semantic representation, and attribute-based access verification is performed on the data fields in the structured semantic representation based on role attributes and data tags; Based on the results of attribute base access verification, data fields in the structured semantic representation that have no access permissions are marked; Integrate the tagging results with the structured semantic representation to generate a validated structured semantic representation.

4. The secure data retrieval and traceability method as described in claim 1, characterized in that, Based on the verified structured semantic representation and metadata graph, an executable query statement adapted to the target database is constructed, including: Parse the verified structured semantic representation to extract the set of query objects and the set of query conditions; Based on the set of query objects, retrieve the metadata graph that stores the data table structure and relationships, and obtain the corresponding data table structure information; Based on the set of query conditions and the data table structure information, a query statement draft is generated; The query statement draft is then syntactically optimized to generate the initial query statement; Verify the compatibility of the initial query statement with the target database; Based on the compatibility verification results, the initial query statement is adjusted to generate an executable query statement adapted to the target database.

5. The secure data retrieval and traceability method as described in claim 1, characterized in that, Execute the executable query statement in the target database to obtain initial query results, and perform statistical reasonableness verification on the initial query results, including: Establish a connection session with the target database; The executable query statement is executed in the target database through the connection session to obtain the original data set; Data sampling is performed on the original dataset to generate a verification sample set; Determine the statistical distribution characteristics of the verification sample set; The statistical distribution characteristic values ​​are compared and analyzed with a preset reasonableness threshold; Based on the comparative analysis results, a conclusion is generated regarding whether the statistical rationality check has passed, and the conclusion includes the identification of abnormal data distribution.

6. The secure data retrieval and traceability method as described in claim 1, characterized in that, If the initial query result passes the statistical reasonableness check, the initial query result is scanned using the sensitive field detector configured in the pluggable compliance plugin chain, including: Load the sensitive field detector from the pluggable compliance plug-in chain; Obtain the predefined sensitive data pattern strategy set from the sensitive field detector; Iterate through the sequence of data fields in the initial query result; Perform pattern matching between each data field in the data field sequence and the sensitive data pattern strategy set; Record the successfully matched sensitive data fields and the corresponding sensitive data tags for those fields; Generate a sensitive field scan report containing all successfully matched sensitive data fields and their corresponding sensitive data tags.

7. The secure data retrieval and traceability method as described in claim 1, characterized in that, If sensitive data tags are detected, the de-identification strategy in the pluggable compliance plugin chain is invoked to process the initial query results to generate the target data view, including: Load the desensitization strategy corresponding to the scanned sensitive data tags from the pluggable compliance plug-in chain; The desensitization strategy is analyzed to obtain the field-level desensitization processing strategy; Identify sensitive data fields in the initial query results that carry the sensitive data tag; The data fields in the initial query results are categorized into sensitive data fields and non-sensitive data fields; According to the field-level desensitization processing strategy, the corresponding desensitization conversion operation is performed on the sensitive data field to generate the desensitized data field; The anonymized data fields are integrated with the non-sensitive data fields to generate an intermediate data view; The intermediate data view is formatted to generate the target data view.

8. A secure data retrieval and traceability device, characterized in that, The secure data retrieval and tracing device includes: The semantic parsing and fusion module is used to receive natural language query instructions, and semantically fuse the natural language query instructions with domain knowledge in a preset knowledge base to obtain a structured semantic representation; The access verification and compliance control module is used to load the pluggable compliance plugin chain, input the structured semantic representation into the pluggable compliance plugin chain, perform attribute-based access verification according to the current visitor's role attributes, and output the verified structured semantic representation. The query construction and database adaptation module is used to construct an executable query statement adapted to the target database based on the verified structured semantic representation and metadata graph. The data execution and statistical verification module is used to execute the executable query statement in the target database to obtain initial query results, and to perform statistical reasonableness verification on the initial query results; The sensitive field scanning module is used to scan the initial query result using the sensitive field detector configured in the pluggable compliance plug-in chain if the initial query result passes the statistical reasonableness check. The data anonymization and view generation module is used to process the initial query results to generate a target data view by invoking the anonymization strategy in the pluggable compliance plugin chain if sensitive data tags are detected.

9. A computer device, characterized in that, The computer device includes a memory, a processor, and a secure data retrieval and tracing program stored in the memory and executable on the processor. When executed by the processor, the secure data retrieval and tracing program implements the steps of the secure data retrieval and tracing method as described in any one of claims 1-7.

10. A non-volatile computer-readable storage medium, characterized in that, The storage medium stores a secure data retrieval and tracing program, which, when executed by a processor, implements the steps of the secure data retrieval and tracing method as described in any one of claims 1-7.

Images