Dynamic generation and control method and device for policy-driven data security sandbox

Abstract

The invention relates to the technical field of artificial intelligence and data security, in particular to a dynamic generation, management and control method and device for a policy-driven data security sandbox.The method comprises the steps that multiple policies are obtained to form a unified fusion policy set; calling a container scheduling platform API to create a sandbox instance; when the sandbox instance runs, capturing a sensitive event in real time, comparing the sensitive event with the fusion strategy set, and terminating a violation process when a violation behavior is found through comparison; after the calculation task in the sandbox is executed, performing compliance filtering on an original calculation result, and returning a compliance result to a data user; and after the task in the sandbox is finished, the sandbox instance and the associated resources are destroyed. By applying the method and the system, active closed-loop management and control of the full life cycle of the sandbox can be realized, so that'availability, invisibility, controllability and measurability 'of data elements can be really realized on higher security level and higher flexibility.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and data security technology, and in particular to a method and apparatus for the dynamic generation and management of a strategy-driven data security sandbox. Background Technology

[0002] With the development of the digital economy, data has become a key factor of production. To promote the secure and compliant flow of data, the industry has proposed the core objective of "data that is usable but invisible, controllable and measurable." Privacy-preserving computing technology is a key technological path to achieve this goal, and the Secure Sandbox technology, also known as a data sandbox or a trusted computing environment based on software isolation, is one of the mainstream technical solutions currently available.

[0003] Existing security sandbox technology typically refers to building a computing environment that is strictly isolated from the external environment through virtualization or containerization technologies (such as Docker, KataContainers, etc.). Data requesters can submit computational tasks such as algorithm code and model training scripts to be executed within this secure sandbox. The secure sandbox environment can load and access authorized data, and its strict boundary access control mechanism prevents code within the sandbox from directly transmitting raw data to the outside, thus achieving a certain degree of separation between data ownership and usage rights. By providing data users with a controlled "black box" environment, security sandbox technology ensures that raw data does not leave the domain and is a fundamental technology for ensuring data security in scenarios such as data exchanges and data circulation platforms.

[0004] Existing security sandbox technologies have significant shortcomings. First, at the policy management level, they exhibit a unidirectional and static characteristic. Security policies are mostly preset unilaterally by the data circulation platform or configured once by the data provider when the data is released. This fails to flexibly respond to the dynamic and reasonable needs of data users in specific computing tasks, and also lacks an automated fusion and conflict resolution mechanism for policies in scenarios involving multiple parties and complex collaborations with multiple responsibilities. Second, at the environment configuration level, there is a problem of one-size-fits-all and crude control. The standardized and general sandbox environment provided does not follow the principle of least privilege in the security domain. For example, simple data aggregation and complex model training are assigned the same broad privileges. The limited permission configuration leaves security risks for malicious code to exploit environmental vulnerabilities and launch attacks. Finally, the control mechanism is passive and limited, focusing only on sandbox boundary protection to prevent raw data from being directly copied out. It lacks effective real-time monitoring and blocking capabilities for violations occurring inside the sandbox. For example, there are no effective control measures for malicious code attempting to initiate unnecessary system calls, probe the internal network, or encode and hide raw data in calculation results. The control chain has obvious gaps in in-process and post-process control, making it difficult to support the core security requirements of data being "usable but invisible, controllable and measurable". Summary of the Invention

[0005] The purpose of this invention is to provide a method and apparatus for the dynamic generation and management of a strategy-driven data security sandbox, which solves the problems of strategy contradictions and lack of effective management in existing security sandbox technologies, and realizes proactive closed-loop management of the sandbox throughout its entire lifecycle. This achieves true "usable but invisible, controllable and measurable" data elements with higher security levels and greater flexibility.

[0006] To achieve the above objectives, the present invention provides the following technical solution: According to one aspect of the present invention, a method for dynamically generating and managing a policy-driven data security sandbox is provided, comprising the following steps: S1: Obtain the data provider's policy, the data user's policy, and the platform's security baseline policy, and generate a unified set of fusion policies; S2: Convert the fusion strategy set into configuration parameters, and call the container scheduling platform API to create a sandbox instance according to the configuration parameters; S3: When the sandbox instance is running, capture sensitive events in real time and compare them with the fusion strategy set. If a violation is found during the comparison, terminate the violating process. S4: After the computation task in the sandbox is completed, the original computation results are filtered for compliance and the compliant results are returned to the data user. S5: After the task within the sandbox is completed, destroy the sandbox instance and its associated resources.

[0007] According to one embodiment of the present invention, in step S1, the format of the fusion strategy set is a JSON or YAML manifest; the data provider strategy includes data access permissions, result output accuracy, and sensitive data restrictions; the platform security baseline strategy includes mandatory audit rules and minimum permission requirements; wherein, the fusion strategy set is generated by merging and deduplicating the three types of strategies and resolving conflicts using a conflict resolution mechanism based on the preset priority rules of data provider strategy > platform security baseline strategy > data user strategy and the principle of the strongest restriction.

[0008] According to an embodiment of the present invention, in step S2, the configuration parameters include: a NetworkPolicy resource object for limiting outbound traffic from the sandbox, a memory file system configuration for storing temporary files, a Seccomp / AppArmor configuration file for limiting system calls, and deploying an internal behavior monitoring agent and a trusted result output filter as a Sidecar container or a main container component.

[0009] According to an embodiment of the present invention, in step S2, creating a sandbox instance specifically includes: customizing a minimal container image, configuring network control rules, setting storage limits, generating a process permission configuration file, injecting an internal behavior monitoring agent and a trusted result output filter, and calling the container scheduling platform API to create a sandbox instance.

[0010] According to one embodiment of the present invention, the process of customizing a minimal container image includes: selecting a base image based on the programming language version and software library dependencies specified in the fusion policy set, installing only the software libraries permitted by the policy set, and removing unnecessary system tools.

[0011] According to one embodiment of the present invention, in step S3, an internal behavior monitoring agent is used to hook the system call points of the container process through eBPF technology to capture sensitive events in real time; after terminating the violating process, audit logs and alarms are reported; wherein, the sensitive events include file opening, network connection establishment, process creation, and system call execution; the violating behaviors include unauthorized disk writing, access to prohibited network addresses, and execution of unauthorized system calls.

[0012] According to one embodiment of the present invention, in step S4, the compliance filtering of the original calculation results using a trusted result output filter includes: performing type and format checks, content sensitivity reviews, precision truncation control, and file permission management. Compliant results are returned to the data user, while non-compliant results are intercepted or anonymized. The content sensitivity review is implemented through regular expression matching or keyword recognition to intercept raw sensitive data; The precision truncation control retains the numerical result according to the number of decimal places specified by the unified fusion strategy set; The file permission control and interception policy prohibits file types or files exceeding the preset size.

[0013] According to one embodiment of the present invention, step S4 further includes the step of injecting differential privacy noise into the numerical result, wherein the noise is Laplace noise and the noise intensity is set according to the ε-differential privacy requirement in the platform security baseline policy.

[0014] According to an embodiment of the present invention, step S5 further includes metering the computing resources consumed throughout the lifecycle of the sandbox and generating a metering report; the associated resources include NetworkPolicy objects, temporary storage volumes, and Seccomp / AppArmor configuration files; the computing resources include the usage and duration of CPU, memory, and GPU.

[0015] On the other hand, the present invention also provides a device for the dynamic generation and management of a policy-driven data security sandbox, the device comprising: The multi-party policy fusion engine is configured to receive policies from data providers, data users, and platform security baseline policies, parse them into a unified internal structure, perform policy fusion and conflict resolution, and generate a unified set of fused policies. The sandbox dynamic builder is configured to communicate with the multi-party policy fusion engine and container scheduling platform, convert the fusion policy set into container configuration parameters, and call the container scheduling platform API to create sandbox instances. The sandbox runtime management module includes an internal behavior monitoring agent and a trusted result output filter. The internal behavior monitoring agent monitors violations through eBPF technology, and the trusted result output filter reviews the compliance of the results. The Sandbox Lifecycle Manager is configured to receive compute task requests, trigger multi-party policy fusion and sandbox construction, receive sandbox runtime alarms, destroy sandbox instances, and meter resources.

[0016] The present invention provides a method and apparatus for the dynamic generation and management of a strategy-driven data security sandbox. Compared with the prior art, the beneficial effects of the present invention are as follows: Through a multi-party policy fusion engine, a policy co-governance model is achieved among data providers, users, and platform providers. This model can dynamically respond to policy requirements in different scenarios. The fusion of multiple policies overcomes the limitations of existing static policies, and the conflict resolution mechanism ensures the consistency and security of policy execution. Through full lifecycle control of policy fusion, sandbox construction, operational monitoring, result filtering, and destruction measurement, the entire process is fully monitorable, auditable, and traceable. Specifically, based on the "principle of least privilege," a customized sandbox environment tightens the attack surface from multiple dimensions, including container images, network, storage, and process permissions. Combined with eBPF real-time monitoring and result filtering, this upgrades from "passive boundary isolation" to "proactive environmental immunity," significantly reducing the security risks of the security sandbox.

[0017] The technical solution of this invention solves the core trust issue in data circulation, enabling data providers to "share with confidence and dare to share," data users to "use data compliantly and efficiently," and platform providers to have "clear responsibilities and be easy to regulate." This provides a solid technical foundation and trust infrastructure for building a secure, efficient, and compliant data element market. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of a strategy-driven data security sandbox dynamic generation and management method according to an embodiment of the present invention; Figure 2This is a schematic diagram of a strategy-driven data security sandbox dynamic generation and control device according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the workflow of the multi-party strategy fusion engine according to an embodiment of the present invention; Figure 4 This is a flowchart illustrating the specific process of dynamically constructing a sandbox instance according to an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating the working principle of the internal behavior monitoring agent in an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the working principle of the reliable result output filter according to an embodiment of the present invention; Figure 7 This is a flowchart illustrating the specific operation of the strategy-driven data security sandbox dynamic generation and control device according to an embodiment of the present invention. Figure 8 This is a schematic diagram of the end-to-end processing of unilateral statistical analysis in the first embodiment of the present invention; Figure 9 This is a schematic diagram of the adjudication and execution process of the dual-data source joint statistical strategy in the second embodiment of the present invention; Figure 10 This is a flowchart of rule matching and de-identification for PII SQL analysis in the third embodiment of the present invention. Detailed Implementation

[0019] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. For example, the first threshold and the second threshold are merely used to distinguish different thresholds and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that the terms "first" and "second" are not necessarily different.

[0020] It should be noted that in this invention, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0021] In this invention, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one" or similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, "at least one of a, b, or c" can represent: a, b, c, a combination of a and b, a combination of a and c, a combination of b and c, or a, b, and c, where a, b, and c can be single or multiple.

[0022] The present invention provides a method and apparatus for the dynamic generation and management of a strategy-driven data security sandbox. It integrates multiple security strategies, dynamically generates a customized sandbox environment for each computing task based on the principle of least privilege according to the integrated strategies, and actively manages the entire lifecycle of the sandbox (including internal behavior and output results). This achieves true "usable but invisible, controllable and measurable" data elements with higher security level and greater flexibility.

[0023] like Figure 1 As shown, a flowchart of a strategy-driven dynamic generation and management method for data security sandboxes is presented. This method includes the following steps: S101, reception and fusion of multiple strategies; Specifically, at least three types of heterogeneous strategies should be accepted: Data provider strategies include data access permissions, result output accuracy, and restrictions on sensitive data. Data user strategies include computing task requirements, resource requests, and operation permission requests; Platform security baseline policies include mandatory audit rules, minimum privilege requirements, and compliance standards.

[0024] The three types of strategies are parsed into a unified internal data structure, such as a standardized JSON object. Based on a preset priority rule: data provider strategy > platform security baseline strategy > data user strategy, and a conflict resolution mechanism (the most restrictive principle), the three types of strategies are merged, deduplicated, and conflict-resolved. Finally, a unified, machine-executable set of integrated strategies is generated, in JSON or YAML manifest format, serving as the basis for subsequent sandbox construction and management.

[0025] S102, dynamically build and generate a security sandbox; Based on the aforementioned fusion strategy set, the abstract strategies are automatically transformed into specific configuration parameters that can be recognized by the underlying container scheduling platform (such as Kubernetes). The API interface of the container scheduling platform is then invoked to create a customized sandbox instance, specifically including the following sub-steps: S1021, Customize a minimal container image: Based on the programming language version and software library dependencies specified by the policy, select a base image (e.g., python:3.9-slim), install only the software libraries allowed by the policy, remove unnecessary system tools, and build a minimal runtime environment; S1022, Configure network control rules: Generate a NetworkPolicy resource object and restrict outbound traffic from the sandbox according to the policy, such as setting egress: [] to block all external network access, or specifying allowed IPs / APIs through a whitelist; S1023, Set storage limits: Mount the data volume in read-only mode, store temporary files in the memory file system (emptyDir with medium:Memory), and prohibit the configuration of persistent storage volumes to ensure that data is not persisted to the ground; S1024, Generate process permission configuration file: Generate Seccomp or AppArmor configuration file according to the policy requirements of the fusion policy set, allowing only necessary system calls such as read, write, and close, and disabling high-risk calls such as execve, fork, and mount; S1025, Inject Control Components: Deploy the internal behavior monitoring agent and trusted result output filter as a Sidecar container or main container component, embedding a sandbox instance.

[0026] S103: Monitoring and violation blocking are performed during sandbox operation; After the sandbox instance starts, the internal behavior monitoring agent uses eBPF (Extended Berkeley Package Filter) technology to mount the system call points of the container process and capture sensitive events in real time, including file opening, network connection establishment, process creation, and system call execution.

[0027] The captured sensitive events are compared with the fusion policy set in real time. If a violation is detected, such as unauthorized disk writing, access to a prohibited network address, or execution of an unauthorized system call, a SIGKILL signal is immediately sent to the violating process to terminate its execution, and detailed audit logs and alarm information are reported to the sandbox lifecycle manager.

[0028] S104: Perform compliance filtering on the calculation results and output them; After the computation task within the sandbox is completed, the raw computation results are transmitted to the trusted result output filter. The trusted result output filter performs a multi-dimensional compliance review based on the policies of the fusion strategy set, specifically including the following 5 checks: (1) Type and format check: Verify whether the output conforms to the preset structure, such as only allowing statistical indicators in JSON format; (2) Content Sensitivity Review: Intercept raw sensitive data, such as detail ID and personal identification information (PII), through regular expression matching or keyword recognition; (3) Precision truncation control: retain the numerical result according to the number of decimal places specified by the strategy to prevent the original data from being deduced from the high-precision data; (4) File permission control: Block file types prohibited by the policy (such as .pkl model files, .h5 data files) or output files exceeding the preset size; (5) Optional differential privacy processing: If required by the platform security baseline policy, Laplace noise is injected into the numerical results, and the noise intensity is set according to the ε-differential privacy requirements.

[0029] Finally, the compliance review results are returned to the data user, and non-compliant results are intercepted, destroyed, or anonymized, and reported to the alert log simultaneously.

[0030] S105: Sandbox Lifecycle Termination and Resource Metering; Regardless of whether the computation task completes successfully or terminates due to a violation, the Sandbox Lifecycle Manager performs the following operations: Call the container scheduling platform API to completely destroy the sandbox instance and all associated resources, including NetworkPolicy objects, temporary storage volumes, Seccomp / AppArmor configuration files, etc. Measuring the computing resources consumed throughout the sandbox's entire lifecycle, including the usage and duration of CPU, memory, and GPU, generates resource metering reports to provide a basis for compliance audits and billing.

[0031] like Figure 2 The diagram shows a schematic of a dynamic generation and control device for a policy-driven data security sandbox. This device is used to implement the above method and specifically includes the following modules: The multi-party policy fusion engine 110 is configured to receive policies from data providers, policies from data users, and platform security baseline policies. It parses the three types of heterogeneous policies into a unified internal data structure, performs policy merging, deduplication, and conflict resolution, generates a unified, machine-executable fusion policy set, and outputs it to the sandbox lifecycle manager. The sandbox dynamic builder 120 is configured to communicate with the multi-party policy fusion engine 110 and the container scheduling platform 160. After receiving the unified fusion policy set, it converts it into specific parameters such as container image configuration, NetworkPolicy, storage limit, and process permission configuration. It calls the container scheduling platform API to create a customized sandbox instance 150 and completes the injection and deployment of management components. The sandbox runtime management module 130 specifically includes two management components: an internal behavior monitoring agent 131 and a trusted result output filter 132. The internal behavior monitoring agent is deployed inside the sandbox instance and uses eBPF technology to capture sensitive system call events in real time. After comparing them with the fusion policy set, it performs violation blocking and log reporting. The trusted result output filter is deployed on the sandbox data output path and performs multi-dimensional review of result type, content, accuracy, and file permissions to achieve compliant output and sensitive data interception. The Sandbox Lifecycle Manager 140 is configured to receive external computing task requests, trigger the multi-party strategy fusion engine to perform strategy fusion, initiate a sandbox creation request to the sandbox dynamic builder, receive sandbox runtime alarms and audit logs in real time, destroy sandbox instances and measure resource consumption after the task is completed, and generate a resource metering report.

[0032] Through systematic functional module design and collaboration, a highly reliable and flexibly customizable data computing environment is built on top of the underlying containerized infrastructure. The overall system presents a multi-layered architecture, with a policy-driven mechanism running throughout the entire lifecycle management of the sandbox. By receiving and integrating fine-grained security and compliance policies from different stakeholders (data providers, data users, and platform operators), these abstract policies are transformed into specific underlying infrastructure configurations, thereby dynamically constructing an isolated computing environment (i.e., a security sandbox) tailored to specific computing tasks and following the principle of least privilege. During sandbox operation, further real-time auditing and blocking of unauthorized operations are conducted through internal behavior monitoring agent 131, and the computing results are rigorously reviewed through trusted result output filter 132, ultimately ensuring that all traces are completely destroyed after the sandbox task ends.

[0033] like Figure 2 As shown, the various components of the policy-driven data security sandbox dynamic generation and management device work together on the underlying infrastructure, such as the Kubernetes container scheduling platform 160, to achieve on-demand generation, precise configuration, runtime monitoring and auditing, and lifecycle management of the sandbox instance 150. The core functions of the sandbox runtime management module 130 are implemented through the internal behavior monitoring agent 131 deployed inside the sandbox instance 150 and the trusted result output filter 132 deployed on the data output path.

[0034] The Multi-Party Policy Fusion Engine 110 serves as the policy decision-making hub, efficiently aggregating, parsing, and unifying heterogeneous security and compliance policies from different stakeholders (including data providers, data users, and platform operators). These policies are typically defined in declarative languages ​​(such as YAML or JSON) and cover multiple dimensions, including data access permissions, permitted computational operation types, network connectivity, file system behavior, and result output format and precision.

[0035] like Figure 3 As shown, the workflow of the multi-party policy fusion engine first parses these raw policies into a unified internal representation, such as an abstract syntax tree or a normalized JSON object. Then, based on preset priority rules and conflict resolution mechanisms—for example, data provider policies typically have the highest priority, followed by platform security baseline policies, and data user request policies have the lowest priority, but the platform can set mandatory rules to cover all low-priority policies—the multi-party policy fusion engine 110 merges, deduplicates, and resolves conflicts among the multi-party policies. For example, if a data provider policy explicitly prohibits the sandbox from any external network access, while a data user request policy includes external network access requirements, the fusion engine will adopt the data provider's strict restriction policy, ensuring that the final unified fusion policy reflects the most stringent security requirements. Finally, the multi-party policy fusion engine 110 outputs a complete, consistent, and machine-executable unified fusion policy set (e.g., a JSON or YAML manifest file) as the basis for subsequent sandbox construction and management.

[0036] Figure 3 The multi-strategy fusion process shown includes the following steps: S201: Data Provider Policy; S202: Request strategy for receiving data from users; S203: Global security baseline policy for receiving platform; S204: Parse all strategies into a unified internal data structure; S205: Initialize the fusion strategy set; S206: Apply priority rules to merge / override policies (e.g., data provider > platform > user), and determine if there are any policy conflicts. If yes, proceed to S207; otherwise, proceed directly to step S209. S207: Implement conflict resolution mechanisms (e.g., the most restrictive principle, platform-mandated rules); S208: Record the conflict resolution process and decision log; S209: Generate the final unified fusion strategy set (JSON / YAML Manifest).

[0037] The sandbox dynamic builder 120 can automatically translate and convert the unified fusion strategy set output by the multi-party strategy fusion engine 110 into specific resource configurations that can be recognized and executed by the underlying container scheduling platform 160 in real time. This conversion process ensures that each sandbox instance 150 is tailored to the current computing task and strictly follows the "principle of least privilege".

[0038] like Figure 4 The diagram illustrates the specific process of dynamically constructing a sandbox instance, including the following steps: S301: Receive unified fusion strategy set; S302: Parse the policy set and extract various configuration requirements; S303: Customize the base environment: Select or build the base container image based on the programming language / library dependencies / container runtime; Based on the programming language version specified in the fusion strategy, required software library dependencies, and container runtime requirements (e.g., forcing the use of Kata Containers to improve isolation), the builder dynamically generates or selects a minimal container image. If no matching pre-built image is available, a Dockerfile can be dynamically generated, a base image (e.g., python:3.9-slim) can be selected, and specified libraries can be installed using a package manager (e.g., pip install) before a customized container image is built.

[0039] S304: Configure network policies: Generate Kubernetes NetworkPolicy, etc., based on network access requirements; If the convergence policy includes "block all external network access" or "allow access only to specific whitelisted IPs", the builder will generate a Kubernetes NetworkPolicy resource object. This object precisely defines the network isolation rules for the sandbox instance, such as blocking all outbound traffic by setting `egress: []`, or specifying the target address to be allowed access by specifying the `to` field, thereby achieving fine-grained network control.

[0040] S305: Configure storage policy: Set the storage volume mount / read-only / memory mode according to the file system / storage requirements; Based on the policy's requirements of "no data persistence" or "read-only mounting," the builder precisely controls how storage volumes are mounted when generating Pod configurations. For example, it may not mount any persistent storage volumes, or may mount data volumes only in read-only mode. For temporary files that may be generated during computation, their storage is restricted to an in-memory file system (such as Kubernetes' emptyDir with medium: Memory) to ensure they are destroyed after the task ends, leaving no trace of sensitive data.

[0041] S306: Restrict process permissions: Generate Seccomp / AppArmor configuration files according to system call requirements; Based on the list of allowed system calls or the instructions to disable dangerous system calls in the policy, the builder automatically generates a Seccomp (Secure Computing mode) configuration file or an AppArmor configuration file. This configuration file is loaded through the Pod's securityContext field, precisely restricting the system call permissions that processes within the container can execute. For example, it allows only necessary operations such as read, write, openat, and close, while disabling system calls such as execve, fork, and mount that could lead to privilege escalation or environment escape, thereby minimizing the attack surface within the sandbox.

[0042] S307: Set resource quotas: Configure CPU / memory / GPU limits; Based on the requirements for computing resources such as CPU, memory, and GPU in the fusion strategy, the builder sets precise resource limits (requests and limits) in the Pod configuration to prevent resource abuse or denial-of-service attacks, while also providing a basis for measurable resources for the platform.

[0043] S308: Injecting control components: Packaging internal behavior monitoring agent and trusted result output filter configuration; When a sandbox instance is created, the builder is responsible for injecting the deployment configuration of the core components of the sandbox runtime management module 130 (internal behavior monitoring agent 131 and trusted result output filter 132) into the Pod's resource manifest, for example, as part of the Sidecar container or the main container.

[0044] S309: Compile and generate an executable resource manifest (e.g., Pod / DeploymentYAML) for the underlying container scheduling platform.

[0045] The sandbox runtime management module 130 is the core of proactive and in-depth management during the operation of the security sandbox, and includes two closely cooperating sub-components: internal behavior monitoring agent 131 and trusted result output filter 132.

[0046] like Figure 5The diagram illustrates the working principle of the internal behavior monitoring agent. The internal behavior monitoring agent 131, a lightweight and highly efficient program, runs within the sandbox instance 150, acting as a "police officer within the sandbox" to achieve real-time, fine-grained monitoring and violation blocking of computational task behavior. The internal behavior monitoring agent 131 is implemented based on eBPF (extended Berkeley Packet Filter) technology. When the sandbox instance starts, the pre-compiled eBPF program is loaded into the host kernel and hooked to the system call points of the sandbox's container processes. The eBPF program can capture all sensitive system call events within the sandbox with extremely low performance overhead, such as openat (file open), write (file write), connect (establish network connection), execve (execute new program), etc. The user-space portion of the internal behavior monitoring agent 131 receives and analyzes these eBPF event streams in real time and compares them with the fusion policy set. Once non-policy-compliant behavior is detected, such as a computing task attempting to write data to a non-memory file system, initiating an unauthorized external network connection, or executing a system call prohibited by the policy, the internal behavior monitoring agent 131 immediately takes response measures, such as sending a SIGKILL signal to the violating process to terminate its execution, and sending detailed violation alerts and tamper-proof audit logs to the sandbox lifecycle manager 140 or an independent audit log system.

[0047] like Figure 6 The diagram shows the working principle of the reliable result output filter.

[0048] The Trusted Result Output Filter 132 is deployed on the critical path of the sandbox data outflow, acting as a "data gate" to rigorously review and filter the output of computation tasks, ensuring that the original data is not leaked. The Trusted Result Output Filter 132 can be deployed as a standalone Sidecar container within the same Pod as the main computation container, or as a smart API gateway at the sandbox exit. All output generated by computation tasks (including standard output streams, log files, result files, etc.) is redirected to the Trusted Result Output Filter. The Trusted Result Output Filter performs multi-dimensional checks based on the definition of result output in the fusion strategy set, specifically including the following check types: (1) Type and format check: Verify that the output conforms to the expected structure, such as statistical indicators in JSON format only.

[0049] (2) Content review: Ensure that the output does not contain any original sensitive data through regular expressions, keyword matching, or simple semantic analysis. For example, if the policy specifies that only aggregate statistics should be returned, the filter will block any output containing original record IDs or detailed data.

[0050] (3) Precision limitation: Automatically truncate the precision of numerical results to prevent the original data from being deduced from high-precision floating-point numbers.

[0051] (4) File type and size restrictions: File types that are explicitly prohibited in the interception policy (such as model files .pkl, .h5) or output files that exceed the specified size.

[0052] Results that do not comply with the policy will be immediately intercepted, destroyed, or anonymized to ensure that only compliant information that poses no risk of leakage is returned to the data user.

[0053] The Sandbox Lifecycle Manager 140 coordinates the entire lifecycle of the sandbox, from creation and operation to resource metering and eventual destruction, providing automated, secure, and metered management capabilities. The Sandbox Lifecycle Manager receives external computing task requests and requests a unified fusion policy for the task from the multi-party policy fusion engine 110. Subsequently, the Sandbox Lifecycle Manager passes the fusion policy to the Sandbox Dynamic Builder 120 to create the sandbox instance 150. During task execution, the Sandbox Lifecycle Manager continuously monitors the running status of the sandbox instance and receives audit logs and alerts from the internal behavior monitoring agent 131. At the end of the task, whether successfully completed or terminated due to violations, the Sandbox Lifecycle Manager accurately meters the CPU, memory, storage, and network I / O resources consumed by the sandbox instance 150 throughout its entire lifecycle through integration with the underlying container scheduling platform 160 (e.g., pulling data from Kubernetes Metrics Server or Prometheus). This data is not only used for billing and resource optimization but also provides detailed evidence for compliance audits. Ultimately, the sandbox lifecycle manager calls the APIs of the underlying container scheduling platform 160 (e.g., kubectl deletepod). <pod-name>Alternatively, use a batch delete command based on the sandbox-id tag to completely and irreversibly destroy sandbox instance 150 and all its associated resources (such as network policies, temporary storage volumes, etc.), ensuring that it is destroyed immediately after use without any data residue.

[0054] The aforementioned modules collaborate to implement the described method flow. Externally input data provider policies, data user policies, and platform security baseline policies converge to the multi-party policy fusion engine 110, which processes and generates a unified fusion policy set. When the sandbox lifecycle manager 140 receives a computation task request, it first obtains the fusion policy for that task through the fusion engine 110. Subsequently, the sandbox lifecycle manager 140 passes the fusion policy to the sandbox dynamic builder 120, requesting it to create and configure a sandbox instance according to the policy. The sandbox dynamic builder 120 calls the API of the underlying container scheduling platform 160 to generate detailed configuration and create a sandbox instance 150 customized for the task, while simultaneously deploying the internal behavior monitoring agent 131 and the trusted result output filter 132 inside the sandbox or its output path. After the sandbox instance 150 is successfully created, the sandbox lifecycle manager 140 starts task execution. During task execution, the internal behavior monitoring agent 131 monitors the internal behavior of the sandbox in real time and feeds back audit logs or alarms to the sandbox lifecycle manager 140. The results of the computation task are reviewed by the trusted result output filter 132 before being returned to the data user. Finally, the sandbox lifecycle manager 140 is responsible for measuring resource consumption and completely destroying the sandbox instance 150 and all associated resources.

[0055] like Figure 7 The diagram illustrates the specific operational flow of the method of the present invention, including the following steps: S601: A computation task request has been received, which includes the required data identifier, the algorithm code to be executed, and the initial security policies from the data provider, the data user, and the platform.

[0056] S602: The multi-party strategy fusion engine 110 parses, resolves conflicts, and fuses the received multi-party strategies to generate a unified fusion strategy set.

[0057] S603-S605: The Sandbox Lifecycle Manager 140 initiates the sandbox creation process, calls the Sandbox Dynamic Builder 120, generates refined environment configuration parameters based on the fusion strategy set, and calls the underlying container scheduling platform API to create a sandbox instance 150 tailored for this task, which is injected with an internal behavior monitoring agent 131 and a trusted result output filter 132.

[0058] S606-S608: The computation task begins execution within the isolated sandbox instance 150. During this period, the internal behavior monitoring agent 131 continuously operates, monitoring all actions of the task in real time. If any operation violating the fusion policy is detected, it will be immediately blocked and an alarm will be triggered, terminating the task.

[0059] S609-S612: If the task is completed normally, its original calculation results will be sent to the trusted result output filter 132. The results will be strictly reviewed according to the fusion strategy. Only compliant results will be allowed to be returned to the data user. Non-compliant results will be intercepted or de-identified.

[0060] S613: Regardless of whether the task succeeds or fails, the sandbox lifecycle manager 140 will perform resource metering after the task process ends and completely and irreversibly destroy the one-time sandbox instance 150 and all its associated resources, ensuring that it is destroyed after use.

[0061] Example 1: Minimum Permission Sandbox for Unilateral Statistical Analysis.

[0062] In a single-table statistical analysis scenario provided by data provider A, the data provider explicitly requires that external network access be prohibited, the data volume be mounted in read-only mode, no data write-to-disk operations be allowed during the calculation process, only statistical operations are permitted, and the results must be returned in JSON format as aggregate metrics. The calculation task submitted by the data user is a Python script that performs basic statistics such as count, mean, and std. To address these constraints and requirements, the multi-party policy fusion engine 110 first receives the data provider's policy, the platform security baseline policy, and the task request, and generates a unified fusion policy set accordingly. This fusion process ensures that the data provider's high-priority rules regarding network and storage restrictions are preserved, while the platform baseline supplements the requirements for minimum permissions and mandatory auditing.

[0063] During the sandbox dynamic build phase, the sandbox dynamic builder 120 customizes the basic execution environment according to the fusion strategy, selecting minimal images such as python:3.9-slim, installing only necessary libraries such as NumPy and Pandas, and removing unnecessary system tools to reduce the exploitable attack surface from the source. Regarding network policies, the builder generates a NetworkPolicy that completely emptys the egress to block all outbound traffic. For storage, data volumes are mounted in read-only mode, temporary directories are set to memory state (emptyDir.medium=Memory), and no persistent volumes are configured, ensuring that intermediate results and temporary data are destroyed immediately after the task ends. To control process behavior, the builder also generates and loads the Seccomp configuration file, allowing only basic system calls such as openat, read, and close, and explicitly prohibiting calls such as execve, fork, mount, and connect that may lead to privilege escalation or environment escape. Subsequently, the sandbox runtime management module 130 is deployed along with the sandbox instance 150. The internal behavior monitoring agent 131 uses eBPF technology to hook and audit all sensitive calls at the kernel layer. Once any behavior inconsistent with the policy is detected, it is immediately blocked and reported. The trusted result output filter 132 is deployed on the result output path, performing multi-dimensional reviews of the type, content, and precision of external returns, allowing only JSON with the structure {metric: value} to pass, and uniformly truncating numerical precision to four decimal places. The entire execution process is coordinated by the lifecycle manager 140, which is responsible for task-level resource metering, audit log collection, and complete "use-and-burn" destruction.

[0064] like Figure 8 The diagram illustrates the end-to-end processing flow of unilateral statistical analysis. Steps E101 to E107 correspond sequentially to task and policy reception, policy fusion, sandbox construction and startup, real-time system call monitoring, result filtering and return, resource metering and auditing, and final destruction. Through this process, the system constructs a customized sandbox for statistical analysis based on the principle of least privilege, ensuring that data remains within the domain, actions are auditable, and results are usable but not visible.

[0065] Example 2: Conflict resolution and collaborative execution of joint statistics from two data sources.

[0066] In a scenario where data provider A and data provider B need to conduct joint statistical analysis, A's policy limits the result precision to no more than three decimal places and prohibits external network access, while B's policy allows access to the platform's internal API and requires the results to include a confidence interval. Both parties prohibit the export of detailed data. The platform's baseline policy enforces minimum permissions and auditing. The data user requests improved result precision. Faced with these multi-source constraints, the fusion engine 110 performs unified analysis and priority adjudication of each party's policies: external network access is "prohibited"; internal network access is only allowed through whitelisted APIs; result precision follows the principle of the strongest restriction, taking the minimum value from all three sources and using three decimal places as the final standard; regarding result fields, the mean and variance are retained, and upper and lower bounds of the confidence interval are added to meet B's compliance requirements while preventing any detailed data leakage.

[0067] In terms of specific construction, builder 120 configures dual data volumes for sandbox instance 150 and mounts them in read-only mode. Temporary intermediate states are stored only in the memory directory and no persistent files are generated. Network policies limit access to the platform's intranet APIs through a NetworkPolicy whitelist to prevent any unauthorized external connections. During operation, internal behavior monitoring agent 131 identifies and blocks possible detailed export attempts; trusted result output filter 132 strictly verifies the field whitelist and precision boundaries in the output path, allowing only {mean, var, ci_low, ci_high} structured JSON returns and automatically truncating numerical precision to three decimal places. The entire joint statistics process is coordinated and executed by lifecycle manager 140, which completes resource metering and sandbox destruction after the task is completed.

[0068] like Figure 9 As shown, a schematic diagram of the joint statistical strategy adjudication and execution process from two data sources is presented. Steps F201 to F210 sequentially represent strategy collection, parsing and merging, conflict adjudication and log recording, sandbox construction and control component injection, joint statistical calculation and in-process blocking, result filtering and precision control, and finally measurement and destruction. Figure 9 As shown in the above process, this invention achieves computable strategy fusion and strong constraint implementation in complex scenarios involving multiple parties, ensuring both the usability and compliance of the results.

[0069] Example 3: SQL analysis and result anonymization of sensitive PII.

[0070] For datasets containing Personally Identifiable Information (PII), the data provider explicitly stipulates that PII fields can only appear in aggregation operations, prohibiting any queries that select raw details, and requiring the use of only whitelisted SQL (such as combinations of COUNT, AVG, SUM, and GROUP BY), while also prohibiting file export. The platform's baseline policy, based on this, enables SQL syntax review and mandatory auditing, and can enable differential privacy (DP) noise injection as needed to further reduce the risk of re-identification. The data user requests the generation of grouped aggregation reports, aiming to produce statistical information along the dimensions of region and age group.

[0071] In this scenario, the lifecycle manager 140 enables SQL whitelisting and (optionally) differential privacy configuration for tasks, while the builder 120 injects an SQL parser and DP module inside the sandbox to ensure that the execution path is controlled from the outset. When a computation task submits an SQL statement, the parser first transforms it into an abstract syntax tree (AST) and performs structural and semantic matching with the whitelist rules; any statement containing a SELECT statement... Statements with non-whitelisted structures, such as JOIN or subqueries, will be directly rejected and an error message will be returned. For statements that pass the whitelist review, the sandbox loads the data volume in read-only mode, prohibits external network access, and stores intermediate results in a memory directory; the internal behavior monitoring agent 131 continuously audits system calls, and immediately blocks any write to disk or file export behavior. If the platform policy enables differential privacy, Laplace noise is injected into numerical aggregation results such as COUNT and AVG to meet the set ε-differential privacy strength, where the ε value comes from the platform's unified policy. In the result return stage, the trusted result output filter 132 only allows JSON output with the structure {group_key, count, avg, sum}; if differential privacy is enabled, the return will also include {epsilon, noise_type} metadata for auditing and compliance verification.

[0072] like Figure 10 As shown, a flowchart of rule matching and desensitization for PII SQL analysis is presented. Steps P301 to P308 describe the complete chain from policy and SQL reception, syntax tree parsing and whitelist review, controlled execution and real-time blocking within the sandbox, differential privacy noise injection, output filtering and return, to resource metering and sandbox destruction. Based on this process, this invention achieves triple protection of "controlled statements, controlled behavior, and controlled results" in highly sensitive data scenarios involving PII.

[0073] The method and apparatus for dynamic generation and management of data security sandbox based on policy-driven approach of the present invention can be widely applied in the field of privacy computing technology in the context of data element circulation. It is particularly suitable for scenarios such as data exchanges, data circulation platforms, and multi-party data collaboration. Through customized isolated computing environment and closed-loop management throughout the entire life cycle, it achieves the core management goal of data being "usable but invisible, controllable and measurable", providing reliable technical support for the safe and compliant circulation of data.

[0074] The proposed method utilizes a multi-party policy fusion engine to achieve a policy co-governance model among data providers, users, and platform providers. This allows for dynamic responses to policy requirements in different scenarios, overcoming the limitations of existing static policies. A conflict resolution mechanism ensures consistency and security in policy execution. Through full lifecycle control encompassing policy fusion, sandbox construction, operational monitoring, result filtering, and destruction measurement, the entire process is fully monitorable, auditable, and traceable. Specifically, a customized sandbox environment based on the "principle of least privilege" tightens the attack surface from multiple dimensions, including container images, network, storage, and process permissions. Combined with eBPF real-time monitoring and result filtering, this upgrades from "passive boundary isolation" to "proactive environmental immunity," significantly reducing the security risks of the security sandbox.

[0075] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and other materials. In this specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several of the functions listed in the specification. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0076] Although the invention has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made therein without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if such modifications and modifications fall within the scope of the invention and its equivalents, the invention is also intended to include such modifications and modifications.

Claims

1. A method for dynamically generating and managing a strategy-driven data security sandbox, characterized in that, Includes the following steps: S1: Obtain the data provider's policy, the data user's policy, and the platform's security baseline policy, and generate a unified set of fusion policies; S2: Convert the fusion strategy set into configuration parameters, and call the container scheduling platform API to create a sandbox instance according to the configuration parameters; S3: When the sandbox instance is running, capture sensitive events in real time and compare them with the fusion strategy set. If a violation is found during the comparison, terminate the violating process. S4: After the computation task in the sandbox is completed, the original computation results are filtered for compliance and the compliant results are returned to the data user. S5: After the task within the sandbox is completed, destroy the sandbox instance and its associated resources.

2. The method according to claim 1, characterized in that, In step S1, the fusion strategy set is in the format of JSON or YAML manifest; the data provider strategy includes data access permissions, result output accuracy, and sensitive data restrictions; the platform security baseline strategy includes mandatory audit rules and minimum permission requirements; wherein, the fusion strategy set is generated by merging and deduplicating the three types of strategies and resolving conflicts using a preset priority rule of data provider strategy > platform security baseline strategy > data user strategy and a conflict resolution mechanism based on the most restrictive principle.

3. The method according to claim 1, characterized in that, In step S2, the configuration parameters include: a NetworkPolicy resource object for limiting outbound traffic from the sandbox, a memory file system configuration for storing temporary files, a Seccomp / AppArmor configuration file for limiting system calls, and deploying the internal behavior monitoring agent and trusted result output filter as a Sidecar container or the main container component.

4. The method according to claim 3, characterized in that, In step S2, creating a sandbox instance specifically includes: customizing a minimal container image, configuring network control rules, setting storage limits, generating a process permission configuration file, injecting an internal behavior monitoring agent and a trusted result output filter, and calling the container scheduling platform API to create a sandbox instance.

5. The method according to claim 4, characterized in that, The process of customizing a minimal container image includes: selecting a base image based on the programming language version and software library dependencies specified in the fusion policy set, installing only the software libraries permitted by the policy set, and removing unnecessary system tools.

6. The method according to claim 4, characterized in that, In step S3, the internal behavior monitoring agent uses eBPF technology to hook the system call points of the container process to capture sensitive events in real time. After terminating the unauthorized process, report the audit log and alarm; the sensitive events include file opening, network connection establishment, process creation, and system call execution; the unauthorized behaviors include unauthorized disk writing, access to prohibited network addresses, and execution of unauthorized system calls.

7. The method according to claim 4, characterized in that, In step S4, compliance filtering of the original calculation results using a trusted result output filter includes: performing type and format checks, content sensitivity reviews, precision truncation control, and file permission management. Compliant results are returned to the data user, while non-compliant results are blocked or anonymized. The content sensitivity review is implemented through regular expression matching or keyword recognition to intercept raw sensitive data; The precision truncation control retains the numerical result according to the number of decimal places specified by the unified fusion strategy set; The file permission control and interception policy prohibits file types or files exceeding the preset size.

8. The method according to claim 7, characterized in that, Step S4 further includes the step of injecting differential privacy noise into the numerical results, wherein the noise is Laplace noise and the noise intensity is set according to the ε-differential privacy requirements in the platform security baseline policy.

9. The method according to claim 1, characterized in that, Step S5 also includes measuring the computing resources consumed throughout the sandbox's lifecycle and generating a measurement report; The associated resources include NetworkPolicy objects, temporary storage volumes, and Seccomp / AppArmor configuration files; The computing resources include the usage and duration of CPU, memory, and GPU.

10. A device for dynamically generating and managing a strategy-driven data security sandbox, used to implement the method described in any one of claims 1 to 9, characterized in that, The device includes: The multi-party policy fusion engine is configured to receive policies from data providers, data users, and platform security baseline policies, parse them into a unified internal structure, perform policy fusion and conflict resolution, and generate a unified set of fused policies. The sandbox dynamic builder is configured to communicate with the multi-party policy fusion engine and container scheduling platform, convert the fusion policy set into container configuration parameters, and call the container scheduling platform API to create sandbox instances. The sandbox runtime management module includes an internal behavior monitoring agent and a trusted result output filter. The internal behavior monitoring agent monitors violations through eBPF technology, and the trusted result output filter reviews the compliance of the results. The Sandbox Lifecycle Manager is configured to receive compute task requests, trigger multi-party policy fusion and sandbox construction, receive sandbox runtime alarms, destroy sandbox instances, and meter resources.

Images