Evidence chaining data desensitization method fusing blood relationship constraint and version fingerprint

Abstract

The present application relates to the field of data security and desensitization processing, and discloses a method for evidence chaining data desensitization fusing field blood relationship constraint and version fingerprint, comprising the following steps: constructing a field blood relationship graph and obtaining a normalized dependency degree by formula calculation, matching a strategy subset for a field to be processed, filtering and outputting a feasible strategy solution set according to a back-identification risk threshold, adopting formula calculation to output a desensitization strategy matrix, wherein a normalized dependency degree is introduced as a penalty term for trace retention value, executing desensitization by using the desensitization strategy matrix and generating a strategy abstract, coupling with a processing context abstract and a previous stage fingerprint, calculating a current stage fingerprint and a record abstract value; comparing and verifying a reconstructed fingerprint in a state to output drift information and trigger a response mechanism to control a link. The present application balances desensitization strength and utility by using field blood relationship constraint, establishes a chain evidence structure through a version fingerprint, and realizes whole-process tamper-proof right confirmation and abnormal change self-recovery control.

Description

Technical Field

[0001] This invention relates to the field of data security and desensitization processing, specifically to a data desensitization method that integrates field lineage constraints and version fingerprints into an evidence chain. Background Technology

[0002] In the processing and utilization of multi-source heterogeneous structured data, data anonymization, derivative processing, and process logging are fundamental steps to ensure that data meets compliance requirements in scenarios such as audit verification and data sharing. To support subsequent review and compliance checks, the anonymization process needs to output the target dataset and provide information such as the source of the dataset fields, the processing path, and the basis for the anonymization.

[0003] Existing data masking solutions primarily rely on field sensitivity levels, back-identification risks, and data availability when determining field-level masking strategies. Because these methods fail to consider the importance of fields within the lineage topology, core fields on critical derivation chains or audit chains are often subjected to high-intensity masking algorithms, leading to reduced downstream business availability. Furthermore, cross-stage consistency checks typically only target data content summaries or batch numbers, lacking the ability to identify changes in field lineage, rule set versions, model parameters, and masking strategy matrices. Since the evidence chain only records batch-level summaries or logs, it cannot prove the specific basis for the target dataset's generation. This results in downstream release decisions depending solely on the completion status of upstream tasks, making it difficult to identify compliance risks caused by configuration tampering or version drift, and failing to establish processing credentials with tamper-proof characteristics. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an evidence chain-based data desensitization method that integrates field lineage constraints and version fingerprints. This method solves the problems of data usability impairment, incomplete evidence chains, and inability to effectively identify version drift caused by the lack of quantitative consideration of field lineage structure and consistency verification of cross-stage generation basis in existing technologies.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] This invention provides a method for de-identifying evidence chains by fusing lineage constraints and version fingerprints, comprising the following steps:

[0007] Obtain the dataset to be processed, construct a field lineage diagram, and calculate the normalized dependency degree using the field dependency formula and the normalized dependency formula;

[0008] A subset of candidate desensitization strategies is matched for the field to be processed, and the strategies are simulated on randomly sampled samples. The risk of back identification and the risk reduction value are calculated, and the feasible strategy solution set is filtered out according to the preset risk threshold of back identification.

[0009] The comprehensive score of the feasible strategy solution set is calculated using the utility retention formula, strategy matching formula, retrospective retention formula and comprehensive scoring formula to output the desensitization strategy matrix. Normalized dependency is introduced as a penalty term when calculating the retrospective retention value.

[0010] The dataset to be processed is processed using the desensitization strategy matrix to generate output batch summaries. The desensitization strategy matrix summaries are generated by combining normalized dependency segmentation. The current stage version consistency fingerprint is obtained by combining each summary with the previous stage version consistency fingerprint using the stage fingerprint formula. The current stage record summary value is generated using the record summary formula.

[0011] The reconstructed version consistency fingerprint obtained in the verification state is compared with the current stage version consistency fingerprint to output version drift information, triggering a multi-level response mechanism to control the data flow link and complete the evidence chain data desensitization.

[0012] This invention introduces a topological importance assessment mechanism during the processing. By receiving processing context such as field lineage mapping relationships, stage rule sets, and model parameter information, a field lineage graph covering original field nodes, intermediate field nodes, and derived field nodes is constructed. Field dependency degrees are derived by extracting node degree and path reachability features using field dependency formulas, and then normalized dependency degrees are output after smoothing calculations. The normalized dependency degree quantifies the potential impact of changes in a single field on the global data lineage.

[0013] In the strategy optimization and filtering phase, this solution matches a subset of candidate de-identification strategies based on the processing scenario and field type. Simulated de-identification is performed on randomly sampled data, and the risk of re-identification is calculated using a re-identification risk formula. Combined with the baseline risk, a risk reduction value representing the improvement in privacy and security is derived. Compliance constraints are established through a preset re-identification risk threshold, and candidate de-identification strategies that do not meet the constraints are eliminated to output a set of feasible strategy solutions.

[0014] This scheme establishes a multi-dimensional strategy evaluation model. It uses the utility retention formula and strategy matching formula to evaluate the impact of de-identification processing on data statistical distribution and downstream task indicators. When calculating the traceability retention value, normalized dependency is introduced as a penalty term into the calculation of the traceability loss coefficient. This mechanism ensures that fields at core network nodes are subject to scoring suppression when matching irreversible de-identification algorithms, thereby selecting the target de-identification strategy based on the comprehensive score to construct a de-identification strategy matrix, while simultaneously maintaining a queue of candidate strategies.

[0015] To solidify the evidence chain in the anonymized state, this scheme utilizes an anonymization strategy matrix to perform an anonymization algorithm operation on the dataset to be processed, generating the target dataset and output batch summaries. Dynamic granular segmentation is performed based on normalized dependency, distinguishing between intervals defined by high-risk thresholds and marginal thresholds, generating an anonymization strategy matrix summary. Combining the field lineage graph summary, rule version summary, and model version summary, these summaries are coupled with the previous stage version consistency fingerprint using a stage fingerprint formula to obtain the current stage version consistency fingerprint. This fingerprint is further concatenated with the previous stage record summary value to generate the current stage record summary value, forming a forward-dependent chained credential structure.

[0016] In the cross-stage execution comparison, the downstream environment extracts local summaries and performs verification state calculations to obtain the reconstructed version consistency fingerprint. By comparing it with the transparent current stage version consistency fingerprint, the source of inconsistency is located to output version drift information.

[0017] The executing entity triggers a corresponding multi-level response mechanism based on the drift type:

[0018] When a policy drift occurs, trace the chain of evidence and extract the suboptimal policy from the alternative policy queue to replace the illegally loaded policy.

[0019] When rule drift or model drift occurs, the abnormal lineage nodes are reverse-mapped to the field lineage graph. The breadth-first search algorithm is used to delineate the affected derived node clusters, divide them into infected subgraphs for interception, and allow the processing flow of the immune subgraph.

[0020] When bloodline drift occurs, the differential nodes are extracted, the normalized dependency and comprehensive score are recalculated, and the passage is allowed or blocked in conjunction with safety and utility thresholds.

[0021] This invention provides a method for de-identifying evidence chains by fusing lineage constraints and version fingerprints. It offers the following advantages:

[0022] 1. This invention constructs a field lineage graph containing original, intermediate, and derived nodes and extracts normalized dependencies, which are then introduced as penalty constraints into the calculation of traceability retention values. This effectively reduces the damage to core business nodes caused by highly destructive and irreversible algorithms, and improves the availability of downstream data analysis and model training while meeting privacy and security requirements.

[0023] 2. This invention utilizes normalized dependency to dynamically segment the de-identification strategy matrix at a granular level, and nests and couples stage summaries of different dimensions with the consistency fingerprint of the previous stage version. Combined with the chained transmission of recorded summary values, a context-related state solidification mechanism is established. This method balances the computational overhead of hash calculations while mitigating the risk of historical de-identification records being tampered with at the technical execution level.

[0024] 3. This invention, by performing verification state calculation and comparing it with the expected fingerprint before downstream execution, can identify version drift states of policies, rules, models, or lineage dimensions, and trigger corresponding response actions such as alternative policy replacement, infected subgraph isolation, or execution blocking. This method effectively limits the impact of illegal de-identification configurations or environmental variations, and improves the security management capabilities of heterogeneous data center transfer links. Attached Figure Description

[0025] Figure 1 This is a flowchart of the evidence chain desensitization method for fusing lineage constraints and version fingerprints according to the present invention;

[0026] Figure 2 This is a flowchart of the optimization process for the multidimensional evaluation system of this invention;

[0027] Figure 3 This is a flowchart of the fingerprint generation, recording, and solidification process of the present invention;

[0028] Figure 4 This is a scatter plot comparing the comprehensive scores of the desensitization strategy optimization in the application embodiments of the present invention. Detailed Implementation

[0029] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Please see the appendix Figure 1 This invention provides a method for de-identifying evidence chaining data by fusing lineage constraints and version fingerprints, comprising the following steps:

[0031] S1. Obtain the dataset to be processed and construct a field lineage graph to quantify the topological importance of fields to output normalized dependencies.

[0032] The system receives the dataset to be processed from external multi-source heterogeneous data centers, along with the processing context. The processing context includes field lineage mapping relationships, stage rule sets, model parameter information, a set of candidate de-identification strategies, and the processing scenario. It also receives the field type and back-identification risk threshold for each field to be processed. Data is extracted from the dataset to be processed according to a preset scale, generating random sampling samples. Subsequently, a field lineage graph containing original field nodes, intermediate field nodes, and derived field nodes is constructed based on the field lineage mapping relationships. The field lineage graph reflects direct mapping, transformation, aggregation, and derived dependencies in data flow. For each field to be processed in the field lineage graph, the node dependency degree is quantified using a field dependency formula to obtain the field dependency degree. Then, a normalized dependency formula is used to smooth and normalize it, calculating the normalized dependency degree.

[0033] S2. Simulate the candidate desensitization strategy set based on random sampled samples, calculate its re-identification risk, and perform constraint filtering according to the security threshold to output the feasible strategy solution set.

[0034] Based on the field type and processing scenario, a subset of candidate de-identification strategies is matched for each field to be processed. Each candidate de-identification strategy is simulated on randomly sampled data, and the re-identification risk is calculated using the re-identification risk formula. Combining the baseline risk from external input, the risk reduction value corresponding to each candidate de-identification strategy is calculated using the risk reduction value formula. It is verified whether the re-identification risk is less than or equal to the re-identification risk threshold; candidate de-identification strategies that do not meet the constraints are deleted, and the remaining candidate de-identification strategies are output as the feasible strategy solution set.

[0035] S3. Establish a multi-dimensional evaluation system to perform global scoring and optimization of feasible strategy solutions, output the desensitization strategy matrix composed of target desensitization strategies, and cache the candidate strategy queue.

[0036] For the feasible strategy solution set, the utility retention value is calculated using the utility retention formula on randomly sampled samples, and the strategy matching value is calculated using the strategy matching formula. Simultaneously, normalized dependencies are extracted and combined with the feasible strategy solution set, and the retrospective retention value is calculated using the retrospective retention formula. By integrating the risk reduction value, utility retention value, strategy matching value, and retrospective retention value, a comprehensive scoring formula is used to calculate the comprehensive score for each candidate de-identification strategy. Based on the comprehensive score, the strategy with the highest score is selected as the target de-identification strategy, and a de-identification strategy matrix is ​​generated. The candidate de-identification strategies are then arranged in descending order of comprehensive score to construct a candidate strategy queue.

[0037] S4. Perform physical desensitization based on the desensitization strategy matrix, generate an adaptive granularity current stage version consistency fingerprint, and implement chain-like solidification of record digests.

[0038] The anonymization strategy matrix is ​​read and physical operations are performed on the dataset to be processed to generate the target dataset and the corresponding output batch summary. The output batch summary, field lineage graph summary, rule version summary, and model version summary are then normalized and serialized. Simultaneously, normalized dependency and the anonymization strategy matrix are extracted, and dynamic granular segmentation is performed based on high-risk and edge thresholds to generate an anonymization strategy matrix summary. The version consistency fingerprint of the previous stage is obtained, and the current stage version consistency fingerprint is generated using a stage fingerprint formula combined with a preset hash function. The current stage record is constructed, and the current stage version consistency fingerprint and the previous stage record summary value are written into it. The current stage record summary value is obtained using a record summary formula combined with a preset hash function to form a chain of evidence solidification.

[0039] S5. Before the downstream stage is executed, the expected fingerprint is compared to determine the drift type and trigger a multi-level response mechanism of intelligent degradation, physical isolation or execution blocking.

[0040] The local rule version summary, local model version summary, local desensitization strategy matrix summary, and local lineage graph summary are extracted as local summaries. These are combined with the output batch summary and the current stage version consistency fingerprint, and a reconstructed version consistency fingerprint is derived using the stage fingerprint formula. The reconstructed version consistency fingerprint is compared with the current stage version consistency fingerprint. If a mismatch is found, the local summary is compared item by item with the rights confirmation summary, and a difference summary and version drift information including policy drift, rule drift, model drift, or lineage drift are output. A multi-level response mechanism includes: for policy drift, tracing the candidate policy queue based on the current stage record summary value, replacing the illegally loaded policy, and recalculating the fingerprint; for rule or model drift, using a breadth-first search algorithm to divide the infected subgraph and immune subgraph, performing interception and release; for lineage drift, comparing the local new version lineage graph to extract differential nodes and differential edges, recalculating normalized dependencies and comprehensive scores, and generating exemption records or blocking the execution process based on security and utility thresholds.

[0041] The technical solutions in the embodiments of the present invention will be described in detail below:

[0042] In this embodiment, the detailed execution process of the specific implementation of S1 is as follows:

[0043] S101, the executing entity receives the dataset to be processed and the processing context from an external multi-source heterogeneous data center. The processing context includes the dataset to be processed, field lineage mapping relationships, stage rule set, model parameter information, candidate de-identification strategy set, and processing scenario. Simultaneously, it receives the field type and back-identification risk threshold corresponding to each field to be processed input from the external multi-source heterogeneous data center.

[0044] As a preferred implementation, the aforementioned model parameter information typically includes the identifier of the pre-trained model structure relied upon by downstream business and its expected input feature vector dimension, which serves as baseline control data for evaluating the impact of the anonymization strategy on the model's utility decay in subsequent steps. The re-identification risk threshold is an empirical value pre-set based on privacy protection regulations and business tolerance in different application scenarios. For example, in the context of medical data anonymization, the re-identification risk threshold for strongly associated identity fields can be set to 0.01 to 0.05.

[0045] When handling large-scale data processing tasks, scanning the entire dataset can easily lead to computational overload and slow down the response speed of strategy optimization. Therefore, data is extracted from the dataset to be processed according to a preset scale to generate random sampling samples. The preset scale is a sampling ratio or a fixed number of rows set based on the computing resources of the executing entity and the data distribution characteristics; for example, it can be set to 1% of the full dataset or a fixed 100,000 rows.

[0046] The generated random samples will be output to subsequent simulation and index calculation steps as the basic data source. For the specific implementation of extracting random samples from large-scale datasets, those skilled in the art can use conventional data sampling algorithms such as simple random sampling, stratified sampling, or pond sampling, which are well-known techniques in the field and will not be elaborated upon here.

[0047] S102, After data sampling is completed, to clarify the cascading relationships in the data flow, a field lineage graph is constructed based on the obtained field lineage mapping relationship, containing original field nodes, intermediate field nodes, and derived field nodes. The field lineage mapping relationship includes the target field identifier, source field identifier, source table identifier, mapping relationship between fields, transformation rule identifier, derivation dependency relationship, and version information.

[0048] In practical applications, the basic fields in the original data table are mapped to original field nodes, fields temporarily generated or transformed during the data flow are mapped to intermediate field nodes, and fields ultimately output or directly supplied to downstream core businesses are mapped to derived field nodes. The directed edges between nodes objectively reflect the direct mapping, transformation, aggregation, and derivation dependencies in the data flow, thus characterizing the data lineage topology at the current stage at both physical and logical levels.

[0049] S103. After establishing the topology, it is necessary to further quantify the importance of each node in the global flow. Specifically, in data anonymization scenarios, applying high-intensity destructive strategies such as random perturbations to derived nodes located at core flow hubs often leads to the failure of a large area of ​​downstream derived data. Therefore, for each field to be processed in the constructed field lineage graph, a topological importance assessment is performed. The absolute dependency of a single node is quantified using a field dependency formula, and the field dependency is calculated as follows:

[0050] ;

[0051] In the formula: For field dependency; Identify the fields to be processed; Fields to be processed; This represents the number of fields that are directly dependent on downstream applications. The number of reachable successor fields; For key chain attributes; For dependency weighting coefficients, and .

[0052] The number of directly downstream dependent fields refers to the number of next-level child nodes in the field lineage graph that have direct directed edges connecting to the current field to be processed.

[0053] The number of reachable successor fields refers to the total number of all downstream nodes that can be reached in the entire field lineage graph by using depth-first search or breadth-first search.

[0054] The critical chain attribute is used to indicate whether the field is on a critical path of business or compliance. It is assigned a constant value of 1 when the field is on a critical derived chain, critical audit chain, or critical sample chain, and a value of 0 otherwise.

[0055] A critical derivation chain refers to a field located on a directed path leading to the final output field where there is no alternative source; a critical audit chain refers to a directed path node where a field is directly referenced by an audit rule set or compliance check procedure; a critical example chain refers to a directed path node where a field is used for the annotation generation, feature construction, or example selection of model training samples.

[0056] The dependency weighting coefficient is a pre-set proportional weight based on direct mapping relationships, indirect cascading effects, and the relative importance of key business attributes in a specific scenario. For example, in scenarios heavily reliant on model training, the weight of key chain attributes can be increased, and it can be set to [value missing]. .

[0057] S104. In actual business operations, different data processing flows often differ in branch complexity and link depth. Directly using absolute dependency values ​​is difficult to serve as a unified penalty benchmark in optimizing cross-stage de-identification strategies. To eliminate differences in metric scales between different business flow nodes, the minimum and maximum field dependency values ​​within the current processing stage are extracted. Furthermore, a normalized dependency formula is used to smooth and normalize the field dependencies, resulting in the normalized dependency value:

[0058] ;

[0059] In the formula: Normalized dependency; For field dependency; This represents the minimum field dependency. This represents the maximum field dependency. This is the normalized smoothing term.

[0060] The normalization smoothing term is a very small positive real number set to prevent the denominator from being zero in extreme topological dead zones where all field dependencies are equal (i.e., the difference between the maximum and minimum values ​​is zero). For example, it can be set to 0.0001.

[0061] The normalized dependency values ​​are smoothly mapped to the range (0,1), which serves as the benchmark parameter for subsequent dynamic adjustment of the traceability retention value and the granularity of fingerprint segmentation, thus ensuring the robustness of the underlying algorithm execution.

[0062] In this embodiment, the detailed execution process of the specific implementation of S2 is as follows:

[0063] S201, based on the field type and processing scenario obtained in S101, match the corresponding subset of candidate de-identification strategies for each field to be processed from the candidate de-identification strategy set obtained in S101.

[0064] As a preferred implementation, field types are typically categorized into direct identifiers, quasi-identifiers, and sensitive data. Regarding this mapping relationship, when the field type is a direct identifier (e.g., ID card number, mobile phone number), the matched subset of candidate de-identification strategies generally includes irreversible hashing, mask replacement, or truncation. When the field type is a quasi-identifier (e.g., date of birth, postal code, gender), the matched subset of candidate de-identification strategies includes data generalization, interval binning, or micro-aggregation. When the field type is sensitive data (e.g., financial salary, clinical diagnosis results), the matched subset of candidate de-identification strategies includes numerical perturbation, differential privacy noise addition, or permutation.

[0065] After matching the subset of candidate de-identification strategies, the candidate de-identification strategies within the subset are simulated and executed on the randomly sampled samples generated in S101. To quantify the potential privacy exposure resulting from strategy execution, a back-identification risk formula is used to evaluate the impact of each candidate de-identification strategy execution, and the back-identification risk is calculated:

[0066] ;

[0067] In the formula: To identify risks; Candidate desensitization strategies; The risk component of back identification caused by uniqueness; This refers to the risk component of back identification caused by cross-inference of external information; For risk component weighting coefficients, and .

[0068] In this computational model, the calculation logic for the risk component of back identification caused by uniqueness is to statistically simulate the k-anonymity characteristics of the desensitized samples and take the reciprocal of its anonymization degree measure. Specifically, the random sampled samples after the candidate desensitization strategy simulation are scanned, and records with the same quasi-identifier attribute value are grouped into the same equivalence class.

[0069] k-anonymity is quantified as the minimum number of records across all equivalence classes. Take its reciprocal. This serves as a component of the back-identification risk arising from this uniqueness. Here... The lower limit of the value is usually set according to the general security standards of the data publishing scenario, such as at least 5.

[0070] For the underlying operations of scanning samples and dividing equivalence classes, those skilled in the art can use conventional frequency statistics or hash aggregation algorithms, which are well-known technologies in the field and will not be elaborated here.

[0071] The calculation logic for the risk component of back identification caused by cross-inference of external information is to calculate the l-diversity index of the desensitized sample and output the proportion of samples whose diversity does not meet the preset conditions.

[0072] In actual calculations, for each of the aforementioned equivalence classes, the distribution of the values ​​of the sensitive fields is statistically analyzed. The preset condition is a lower limit constraint on the distribution of sensitive attributes, set based on the adversarial model assumptions and data diversity requirements. For example, the preset condition can be set to ensure that the number of different values ​​for the sensitive field in each equivalence class is at least three (i.e.,...). Alternatively, the frequency of occurrence of the most frequent sensitive attribute value can be set to no more than a certain percentage (e.g., 50%).

[0073] The equivalence classes that fail to meet the preset conditions are identified, the number of records contained in these non-compliant equivalence classes is summarized, and their proportion to the total number of records in the random sample is calculated. This proportion is used as the risk component of back identification caused by cross-inference of external information.

[0074] The risk component weighting coefficient is a numerical weight set based on the attack methods tendencies of potential attackers and the defensive focus in a specific processing scenario. For example, in scenarios involving publicly released data, attackers are more likely to perform attribute inference attacks by combining external background knowledge; in this case, the weighting coefficient can be increased. The proportion (e.g., setting) In closed-loop data testing environments, the risk of re-identification often stems from internal personnel directly matching unique identifier features. In such cases, adjusting the settings may be necessary. The proportion of.

[0075] S202, further, the purpose of the anonymization process is to achieve a relative reduction in risk. To this end, the baseline risk of the fields to be processed, received from external multi-source heterogeneous data centers, without any anonymization processing, is considered. This baseline risk reflects the initial privacy exposure of the original plaintext data in the transit environment. Combined with the re-identification risk derived from the S201 assessment, the risk reduction value corresponding to each candidate de-identification strategy is calculated using the risk reduction value formula:

[0076] ;

[0077] In the formula: This represents a reduction in risk. Baseline risk; To identify risks; It is a function for maximizing the value; This is a risk smoothing term.

[0078] The risk smoothing term is a very small constant set to prevent computational overflow or division-by-zero anomalies in extreme cases where the baseline risk is zero or close to zero. For example, it can be set to 0.00001.

[0079] By introducing the maximum value function This ensures that the formula denominator has numerical stability when facing original fields with high safety (low baseline risk).

[0080] The risk reduction value represents the relative improvement in the privacy and security level of the field after applying the candidate de-identification strategy. This indicator objectively reflects the protective effectiveness of the strategy.

[0081] After calculating the aforementioned security indicators, it is verified whether the back-identification risk calculated by S201 is less than or equal to the field-level back-identification risk threshold obtained by S101. Candidate de-identification strategies that do not meet this constraint are directly deleted. This filtering process safeguards the bottom line of data flow security and ensures that all subsequent strategies participating in the optimization process meet basic compliance requirements.

[0082] After the above-mentioned constraint filtering, the remaining candidate de-identification strategies are aggregated and output as a feasible strategy solution set. The risk reduction value is passed to subsequent steps for global scoring, and the feasible strategy solution set serves as a qualified strategy library for entering the multi-dimensional evaluation system.

[0083] See appendix Figure 3 In this embodiment, the detailed execution process of the specific implementation of S3 is as follows:

[0084] Considering that risk-constrained filtering can only guarantee security and compliance at the bottom-line level, while the selection of de-identification strategies in complex data processing chains often needs to take into account the availability of data downstream and the audit traceability of the entire chain, a multi-dimensional evaluation system is further established to globally score and optimize the feasible strategy solution set, so as to output a de-identification strategy matrix composed of target de-identification strategies and cache the candidate strategy queue.

[0085] S301, For the aforementioned feasible strategy solution set, evaluate each candidate desensitization strategy using the utility retention formula on randomly sampled samples, and calculate the utility retention value:

[0086] ;

[0087] In the formula: Utility retention value; Preserve values ​​for the statistical distribution of the field; Preserve values ​​for field join relationships; Reserve values ​​for downstream task metrics of the field; For utility weighting coefficients, and .

[0088] When quantifying the above indicators, those skilled in the art can obtain the retained values ​​of the statistical distribution of the fields by calculating the relative entropy (such as KL divergence) or bulldozer distance of the data distribution before and after desensitization and taking its inverse proportional mapping value. This is a well-known technology in the field and will not be elaborated here.

[0089] The field join retention value represents the proportion of records that can maintain the effective inter-table join relationship after the candidate de-identification strategy is implemented. It usually takes the value in the range of [0,1].

[0090] The retained value of the downstream task metric is obtained by retrieving a pre-configured strategy task experience decay mapping table. This table is a pre-built experience dictionary based on the accuracy or recall decay of historical business models when subjected to different de-identification algorithms. For example, when the downstream task is numerical regression and the applied de-identification strategy is high-intensity differential noise addition, the retained value of the metric obtained by retrieving this mapping table might only be 0.4.

[0091] The utility weighting coefficient is a parameter set based on the specific business emphasis of the current data processing batch in terms of statistical analysis, inter-table joins, or machine learning modeling. For example, it can significantly improve the performance when focusing on join queries. The value of .

[0092] Meanwhile, to measure the applicability of the strategy in a specific compliance environment, a strategy matching formula is used to evaluate each candidate de-identification strategy in the feasible strategy solution set, and the strategy matching value is calculated:

[0093] ;

[0094] In the formula: For strategy matching values; The degree of matching to the target scenario; The degree of compliance with rules; The degree of matching required for the review of the chain of evidence; To match the weight coefficients, and .

[0095] Among them, the matching degree of the target scenario reflects the overlap between the strategy algorithm type and the current business declaration scenario tag set; the matching degree of the compliance rules is quantified by comparing whether the security level of the de-identification algorithm covers the internal audit whitelist requirements; the matching degree of the evidence chain review requirements examines whether the strategy has exportable key management logs or disturbance seed records for post-event verification.

[0096] S302. Applying destructive strategies such as random perturbations to core lineage hub nodes often leads to the failure of business availability for a large area of ​​derived data downstream and disrupts the continuity of data traceability. To suppress the damage of highly destructive strategies to key topology nodes, normalized dependency is extracted. Combined with the feasible strategy solution set, a traceability retention formula is used to quantify the indicator characteristics of each candidate de-identification strategy, and the traceability retention value is calculated.

[0097] ;

[0098] In the formula: To retain values ​​in retrospect; The coefficient of determination; Normalized dependency; For retrospective loss coefficient; A percentage is reserved for verifiable links; To trace the weighting coefficients, and .

[0099] The determinism coefficient reflects the stable and invariant characteristics of the output of the desensitization algorithm under fixed input and fixed key (or seed), and its value is limited to [0,1].

[0100] The verifiable link retention ratio assesses the survival rate of logical associations when the target field is reverse-mapped back to the upstream lineage node after de-identification transformation.

[0101] The traceability loss coefficient characterizes the degree of information destruction or irreversibility in a cryptographic sense by the desensitization algorithm. This coefficient is usually set to a low constant value (e.g., 0.1) for fully reversible algorithms (such as AES encryption based on a fixed key) and a high constant value (e.g., 0.9) for irreversible algorithms with random perturbations (such as Gaussian noise).

[0102] As a preferred approach, a penalty term is introduced into the formula. This means that core fields with higher normalization dependency will experience a cascading reduction in their traceability retention value when matched with irreversible, high traceability loss strategies. Because... The values ​​of are all restricted to the range [0,1], and the penalty term is always greater than or equal to zero, thus avoiding the scoring logic dead zone caused by negative values ​​in the formula. This design, which couples graph topological features with cryptographic properties, helps mitigate the risk of uncontrollable contamination of critical flow data.

[0103] S303. After completing the multi-dimensional quantification mentioned above, a global trade-off of the strategy is required. By integrating risk reduction value, utility retention value, strategy matching value, and retrospective retention value, a comprehensive scoring formula is used to calculate the overall score for each candidate desensitization strategy:

[0104] ;

[0105] In the formula: For comprehensive scoring; This represents a reduction in risk. Utility retention value; To retain values ​​in retrospect; For strategy matching values; This is the global evaluation weight coefficient, and .

[0106] The global evaluation weighting coefficient is a pre-set macro-control parameter based on the current stage of the data flow lifecycle. For example, at the output end that is open and shared externally, it can be increased. To strengthen privacy protection; and in the intermediate links of internal data warehouse cleaning, the level can be increased. To ensure the verifiability of data lineage.

[0107] Based on the overall score, the candidate de-identification strategy with the highest score is selected as the target de-identification strategy. The target de-identification strategies matched for each field to be processed are aggregated and combined to generate a field-level de-identification strategy matrix.

[0108] Furthermore, to prevent potential unauthorized modification or version drift that could lead to execution interruptions, the remaining candidate de-identification strategies within the feasible strategy solution set are sorted in descending order based on their comprehensive scores to construct a queue of alternative strategies. In this caching mechanism, the second-best strategy in the queue is prioritized for retention, serving as hot-healing redundant data to address policy environment anomalies, thereby improving the overall fault tolerance of the data flow chain.

[0109] See appendix Figure 4 In this embodiment, the detailed execution process of the specific implementation of S4 is as follows:

[0110] S401, After determining the optimal de-identification strategy, the strategy needs to be physically implemented and data credentials generated for post-audit purposes need to be generated. The executing entity reads the de-identification strategy matrix and applies it to the dataset to be processed to perform physical operations.

[0111] By parsing the rule mappings in the de-identification strategy matrix, the underlying data processing engine is invoked to perform specific de-identification algorithms such as replacement, generalization, and noise addition on the plaintext data line by line or in batches, generating the de-identified target dataset and the corresponding output batch digest. The output batch digest is a unique identifier obtained by combining the data volume of the current batch, the execution timestamp, and the batch serial number through a hash operation. The generated target dataset serves as the final de-identification product of the current stage, either output to external business processes or persistently stored.

[0112] S402. To ensure the verifiability of the data desensitization process, the generated output batch summary, the field lineage graph summary generated based on the constructed field lineage graph, the rule version summary generated based on the acquired stage rule set, and the model version summary generated based on the model parameter information are extracted and normalized and serialized.

[0113] The process of normalized serialization typically involves converting various types of unstructured configuration data into a standard structured format and arranging the keys and values ​​in lexicographical order to ensure the consistency of hash calculation results under different execution environments. For the serialization conversion of various types of structured data, those skilled in the art can use conventional Protobuf or JSON serialization protocols, which are well-known technologies in the field and will not be elaborated upon here.

[0114] Considering that performing full hashing on massive policy parameters would incur significant performance overhead, while a one-size-fits-all coarse-grained hashing would cause core fields to lose audit precision, this embodiment extracts the normalized dependency and de-identification policy matrix and performs dynamic granular segmentation.

[0115] This step introduces pre-configured high-risk and marginal thresholds. These two types of thresholds are empirical reference values ​​set based on data security levels and audit traceability granularity requirements, typically ranging from (0,1). For example, the high-risk threshold could be set to 0.8, and the marginal threshold to 0.3. Based on this, the topological importance of fields is distinguished according to the numerical range of their normalized dependency, and then different summary generation rules are applied.

[0116] If the normalization dependency is greater than the high-risk threshold, it indicates that the field is in the core topology position. Then, the policy type, specific parameters, and temporal features are fully hashed to generate a high-granularity policy matrix summary.

[0117] If the normalized dependency is less than or equal to the high-risk threshold and greater than or equal to the marginal threshold, it indicates that the field has a medium level of importance. Then, the strategy type and core configuration parameters are extracted and hashed to generate a medium-granularity strategy matrix summary.

[0118] If the normalized dependency is less than the edge threshold, it indicates that the field has little impact on the global flow topology. In this case, only the metadata identifier of the policy type is extracted to generate a low-granularity policy matrix summary.

[0119] Integrate the above segmentation results to output a summary of the desensitization strategy matrix.

[0120] To consolidate multi-dimensional discrete summaries into a unified version identifier, and thus obtain the previous stage version consistency fingerprint transmitted by the external transfer engine. By employing a stage fingerprint formula combined with a preset hash function, the digests generated from the above items are tightly coupled with the consistency fingerprint of the previous stage version to calculate the consistency fingerprint of the current stage version. :

[0121] ;

[0122] In the formula: This serves as a consistency fingerprint for the current version. This serves as the identifier for the current processing stage. This serves as an identifier for the previous processing stage; Use the default hash function; This is a consistent fingerprint for the previous version. This is a binary bit string concatenation symbol; To output batch summary; For field lineage graph summary; A summary of the rule version; A summary of the model version; This is a summary of the desensitization strategy matrix.

[0123] As a preferred approach, the preset hash function can employ either SHA-256 or the Chinese national cryptographic algorithm SM3 to ensure the fingerprint information's anti-collision capability. The current version's consistent fingerprint will be output to the subsequent comparison and verification process.

[0124] S403. While simply calculating the fingerprint of the current stage can verify the consistency of the state within that stage, it is insufficient to prevent the complete replacement of historical audit records. Therefore, it is necessary to establish a credential chain with contextual relevance. To this end, a blank current stage record is constructed. The generated current-stage version consistency fingerprint and the digest value of the previous-stage record passed from the outside are written into the current-stage record. middle.

[0125] In the initial phase, since there are no actual physical predecessor nodes, the digest value recorded in the previous phase uses an externally predefined initial digest value. The initial digest value is a fixed bit string set according to the initial configuration, such as a string of all zeros hash value or a hash of a specific project launch identifier.

[0126] For non-initial stages, the record digest value of the previous stage is the record digest value of the current stage generated by the immediately preceding processing stage. Then, the record digest formula combined with a preset hash function is used to calculate the record digest value of the current stage.

[0127] ;

[0128] In the formula: Record the summary value for the current stage; This is a record for the current stage.

[0129] The generated current stage record digest value will not only be passed to downstream stages, but will also be output to subsequent exception handling logic to support backtracking calls. The forward-referenced chain structure ensures that any alteration to historical de-identified records or fingerprints will cause a cascading mismatch in the record digest values ​​of subsequent stages, effectively improving the overall data link credentials' tamper-proof capability.

[0130] In this embodiment, the detailed execution process of the specific implementation of S5 is as follows:

[0131] S501 Before data flows to the downstream processing stage, in order to prevent the risk of privacy leakage caused by changes in the execution environment configuration or malicious tampering, it is necessary to perform an expected comparison of the operating environment and confirmation of status.

[0132] The local summary is extracted from the local rule version summary, local model version summary, local de-identification policy matrix summary, and local lineage graph summary provided by the downstream execution environment. This local summary is obtained through real-time hash calculation of the configuration files, policy script sets, and network topology mappings actually loaded in the current physical execution environment. Subsequently, it is integrated with the output batch summary passed through from the upstream stage and the current stage version consistency fingerprint. Verification state calculation is then performed using the stage fingerprint formula to obtain the reconstructed version consistency fingerprint. This reconstructed version consistency fingerprint characterizes the overall digital features of the current real-world operating state of the downstream environment.

[0133] S502: After obtaining the fingerprint of the verification state, the reconstructed version consistency fingerprint is compared with the current stage version consistency fingerprint received through the pass-through. If the two are completely consistent, it indicates that the context of data flow has not undergone any detectable unexpected changes, and the execution command is allowed normally. Conversely, if a mismatch occurs, the drift tracing logic is triggered. To accurately locate the source of the anomaly, the extracted local digest is compared item by item with the corresponding authorization digest (i.e., the rule version digest, model version digest, desensitization strategy matrix digest, and field lineage graph digest passed through the upstream stage), and the difference digest and version drift information containing the drift type are output.

[0134] Specifically, when the local desensitization strategy matrix summary is inconsistent with the desensitization strategy matrix summary, output strategy drift; when the local rule version summary is inconsistent with the rule version summary, output rule drift; when the local model version summary is inconsistent with the model version summary, output model drift; when the local lineage graph summary is inconsistent with the field lineage graph summary, output lineage drift.

[0135] Once the specific drift type is determined, the execution logic will trigger the corresponding level of safety response based on the abnormal physical properties.

[0136] S503, when the output drift type is policy drift, it indicates that the downstream de-identification algorithm or parameters have been illegally modified. At this point, based on the current stage record summary value, an upstream traceback call is triggered in the evidence chain to extract the second-ranked candidate de-identification policy from the alternative policy queue. This silent replacement mechanism replaces the illegally loaded policy in the downstream environment with this suboptimal policy. After the replacement, the calculation process is re-executed to obtain the repaired reconstructed version consistency fingerprint. If the repaired reconstructed version consistency fingerprint passes the verification, the execution process resumes, improving the fault tolerance and self-healing capability of the overall data flow chain.

[0137] S504 indicates that when the output drift type is rule drift or model drift, it means that the downstream compliance constraints or business modeling logic have changed.

[0138] Model drift typically involves deep neural network models deployed at downstream data consumer ends. For example, when downstream business models use Transformer pre-trained models or residual network models with multi-layer self-attention structures, model drift not only refers to changes in the hash signature of the network weight parameter files (such as physical files in .pth or .onnx format), but also includes unexpected modifications to the dimensional definitions of its input feature tensors (such as sequence length, feature channel number limits), preprocessing concatenation logic, or connection relationships between network layers in the runtime configuration file.

[0139] In this scenario, since the expected input distribution or internal computation graph of the downstream model has deviated from expectations, continuing to supply data may lead to business output failure or the emergence of uncontrollable security escape vulnerabilities. Therefore, the lineage nodes directly associated with the anomaly rules or anomaly models are mapped back to the field lineage graph as the anomaly-caused lineage nodes. A breadth-first search algorithm is then used to identify the cluster of derived nodes affected by these nodes, thus dividing the affected subgraph. The specific traversal mechanism and computational logic of the breadth-first search algorithm can be implemented by those skilled in the art using conventional graph traversal algorithms based on queue data structures, which are well-known technologies in the field and will not be elaborated upon here.

[0140] Based on the partitioning results, the underlying execution tasks related to the affected subgraph are directly intercepted to limit the cascading propagation of the fault's impact. At the same time, the remaining irrelevant topological branches in the field lineage graph are partitioned into immune subgraphs, and the processing flow of the immune subgraphs is allowed to proceed, thereby achieving isolation of the fault's impact.

[0141] In S505, during the actual data flow lifecycle of business operations, changes to the underlying data table structure can lead to lineage drift. When the output drift type is lineage drift, the new local version of the lineage graph generated by downstream probing is extracted, and its structural features are compared with the existing field lineage graph to extract differential nodes and differential edges. For the affected lineage nodes, including differential nodes, the aforementioned topological importance assessment calculation logic is re-executed to obtain the updated normalized dependency. The updated normalized dependency is then substituted into the traceability retention formula and the comprehensive scoring formula to calculate the updated comprehensive score.

[0142] After recalculation, it is necessary to receive externally configured security and utility thresholds to determine whether to grant permission.

[0143] The security and utility threshold is a numerical limit set by comprehensively considering the minimum acceptable risk-reward ratio of data anonymization operations when facing changes in the underlying topology and the minimum requirements for downstream task indicators. Its value range is usually normalized and limited to the [0,1] interval. For example, in scenarios involving external audits, this security and utility threshold can be set to no less than 0.75.

[0144] Then determine whether the updated overall score meets the conditions:

[0145] If the updated overall score is greater than or equal to the safety and utility thresholds, it indicates that the local lineage change has not breached the lower limit of the overall strategy's utility and safety, and an exemption record is generated to allow passage.

[0146] If the updated overall score is less than the safety and utility thresholds, it indicates that the structural changes have caused the existing desensitization strategy to fail. In this case, an alarm signal is triggered and the execution process is completely blocked, thereby reducing the risk of non-compliant data being further leaked.

[0147] To demonstrate the technical execution process and advantages of this invention in a real business scenario, a specific application example based on a medical data sharing scenario is provided below.

[0148] Suppose a provincial-level tertiary hospital (multi-source heterogeneous data center) needs to share a batch of clinical diagnosis and treatment records of cardiovascular diseases with a cardiovascular research institute of a university for joint modeling and prediction.

[0149] First, the dataset to be processed is received. This dataset contains 1 million patient records, and the fields to be processed include: patient ID number (direct identifier), date of birth (quasi-identifier), gender (quasi-identifier), blood pressure value (sensitive data), ECG abnormality markers (sensitive data), and the final coronary artery disease prediction label. The re-identification risk threshold is set at 0.05 (i.e., a maximum tolerance of 5% re-identification probability).

[0150] To control computing power, the execution entity randomly samples 10,000 records at a preset size (1% sampling rate). Subsequently, a field lineage graph is constructed based on internal flow relationships. In this lineage graph, we focus on two field nodes:

[0151] Node A (Patient ID Number): As an original field node, it does not have complex derivation relationships. It is directly mapped to a unique, desensitized code and does not participate in any clinical audit or modeling feature calculations.

[0152] Node B (blood pressure value): As an intermediate / derived field node, it directly affects the downstream cardiovascular risk rating derived fields, is directly referenced by subsequent antihypertensive drug use compliance audit rules, and is one of the core features of target joint modeling.

[0153] Field dependency calculation and normalization. Now, we substitute the data from these two nodes into the field dependency formula. In the middle. The dependency weight coefficient is set to... .

[0154] For node A (ID number): the number of its direct downstream nodes (Mapped only to de-identified IDs), number of reachable successor nodes And it is not on any critical chain, therefore .

[0155] ;

[0156] For node B (blood pressure value): the number of its direct downstream nodes (Risk rating, anomaly marker association), number of subsequent nodes reachable (Affecting multiple joint analysis reports), and located on the critical audit chain and critical sample chain, therefore... .

[0157] ;

[0158] Assuming that the minimum value among all fields calculated in the current stage is The maximum value is Smoothing term Substituting into the normalization dependency formula:

[0159] Normalized dependency of node A: ;

[0160] Normalized dependency of node B: ;

[0161] When matching a desensitization strategy to node B (blood pressure value), assume there are two strategies that will enter the final comprehensive scoring stage:

[0162] Strategy (Medium-intensity micro-polymerization): Tracing loss coefficient .

[0163] Strategy (High-intensity differential noise): Tracing loss coefficient (Highly destructive).

[0164] Because node B is a core hub node ( In calculating the retrospective retention formula Penalty items hour:

[0165] Matching strategy The penalty item score is: ;

[0166] Matching strategy The penalty item score is: ;

[0167] This demonstrates that if highly destructive strategies are applied to the blood pressure value field, which has a high dependence on it... Its score for the retrospective retention dimension will drop significantly (from 0.8348 to 0.3392). Final selection (Micro-aggregation) is the target strategy to avoid uncontrollable contamination of key clinical data.

[0168] When generating the desensitization strategy matrix summary, the high-risk threshold is preset to 0.8 and the marginal threshold is preset to 0.3.

[0169] The normalized dependency of node B (0.826) is greater than the high-risk threshold (0.8). The micro-aggregation strategy type of blood pressure value, cluster center parameters, and execution timestamp are fully hashed to generate a high-granularity summary.

[0170] Node A's normalized dependency (0.130) is less than the edge threshold (0.3), so only its hash replacement strategy metadata identifier is extracted to generate a low-granularity summary.

[0171] Ultimately, these digests, along with the records from the previous stage, participate in a hash operation to generate the digest value for the current stage. This completes the chain-like solidification of vouchers.

[0172] See appendix Figure 4 , attached Figure 4 This demonstrates the process of screening and determining various candidate desensitization strategies through a multi-dimensional evaluation system in the scenario described in this embodiment.

[0173] Appendix Figure 4 The horizontal axis represents the risk reduction value for retrospective identification, and the vertical axis represents the combined score of utility and retrospective retention. (Appendix) Figure 4 The vertical dashed line in the figure represents the minimum risk reduction threshold, which is located at the horizontal coordinate of 0.4. This threshold is the risk reduction baseline converted from the back-identification risk threshold of 0.05.

[0174] The hollow circles distributed to the left of the vertical dotted line represent high-risk strategies that have been eliminated. These strategies are pruned because their risk of back-identification exceeds the back-identification risk threshold and they cannot meet the bottom-line security requirements.

[0175] The crosses distributed to the right of the vertical dashed line represent highly destructive but inefficient strategies. Although such strategies have a high risk reduction value for back-identification, their large back-identification loss coefficient triggers a cascading reduction in back-identification retention values ​​when facing highly dependent nodes, resulting in a low overall level of utility and back-identification retention score (mainly distributed between 0.3 and 0.6 on the vertical axis).

[0176] Appendix Figure 4 The gray solid circles in the diagram represent the set of feasible strategies that enter the final evaluation stage. These strategies are all located to the right of the minimum risk reduction threshold and exhibit good utility and retrospective retention capabilities in the vertical direction.

[0177] Appendix Figure 4 A solid black dot in the upper right corner represents the final selected target anonymization strategy. This strategy maximizes the business utility and lineage traceability of the data while ensuring a low risk of re-identification.

[0178] In addition, Figure 4 The size of each scatter point reflects the degree of dependence penalty response. The scatter point diameter corresponding to the target desensitization strategy is the largest, indicating that it produces the least traceability loss when facing high dependence fields, and its technical utility is the most ideal.

[0179] To further verify the effectiveness of the technical solution of the present invention, this embodiment includes an experimental verification and effect comparison process.

[0180] One million plaintext data entries from the cardiovascular department of a top-tier hospital were selected as the dataset to be processed. Three experimental groups were defined:

[0181] Control group A (traditional static masking method): adopts a fixed hash and physical truncation strategy, without considering the topological relationship between fields.

[0182] Control Group B (Risk Optimization Only): Strategy selection is based solely on the risk formula for back-identification, without introducing field lineage graph constraints.

[0183] Experimental group (this scheme): S1 to S5 of the present invention are fully implemented, and normalized dependency is introduced as a strategy correction factor.

[0184] Data Sampling and Topology Modeling: Random samples are generated at a preset size of 1%. Using S102 of this scheme, a field lineage graph is constructed to identify core hub nodes with high normalization dependencies, such as "blood pressure value" and "blood lipid index".

[0185] Parameter configuration for the computational model: The risk threshold for back-identification is uniformly set to 0.05. In the experimental group, the normalized dependency weight coefficient is set to... The global evaluation weight coefficient is set to... .

[0186] Strategy simulation and multidimensional scoring: Each group calculates the risk of back identification.

[0187] The experimental group invoked the traceability retention formula to match low-destructive strategies for highly dependent nodes.

[0188] By using a comprehensive scoring formula, the target de-identification strategy corresponding to each field is identified, and a de-identification strategy matrix is ​​generated.

[0189] Extraction of beneficial effect indicators: After physical desensitization, the average re-identification risk, utility retention value (assessed by the prediction accuracy of the downstream regression model), and retrospective retention value (assessed by the kinship restoration experiment) of each group were statistically analyzed.

[0190] Table 1 below records the core performance metrics of different technical solutions when processing the same medical dataset:

[0191] Table 1. Comparison and Verification Table of Technical Indicators of Desensitization Schemes

[0192] Indicator Items Control group A (traditional static masking method) Control group B (risk optimization method only) Experimental group (this protocol) Risk identification 0.085 0.046 0.039 Utility Retention Value 0.42 0.65 0.84 Retrospective retention values 0.21 0.38 0.91 Overall score 0.36 0.58 0.87 Fingerprint verification pass rate Unable to verify Unable to verify 99.90%

[0193] Analysis of the above experimental data verifies the scientific validity of the formula logic in this scheme:

[0194] The back-identification risk of control group A (0.085) was higher than the threshold (0.05), leading to compliance failure. However, the experimental group, through physical pruning of S2, forcibly reduced the back-identification risk to 0.039, demonstrating the deterministic role of the back-identification risk formula and constraint filtering mechanism in ensuring the bottom line of security.

[0195] Although control group B met safety standards, its retrospective retention value was only 0.38, mainly because the method misused a highly destructive strategy for core lineage nodes. The experimental group utilized the penalty term in the retrospective retention formula. The system automatically selected a milder strategy for high-dependency fields, which significantly increased the traceability retention value to 0.91, validating the necessity of introducing topological importance into the scoring model.

[0196] The utility retention value of the experimental group reached 0.84, exceeding the 0.42 of the traditional method, indicating that the proposed scheme achieves a deep balance between privacy protection and data value by aligning the statistical distribution in the utility retention formula with the downstream task indicators.

[0197] This solution achieves a verification pass rate of up to 99.9% through the current version consistency fingerprint. In simulated environment drift testing, this solution can accurately identify policy drift and trigger a self-healing response, ensuring the integrity of the evidence chain and the immutability of the processing.

Claims

1. A data anonymization method for evidence chaining that integrates lineage constraints and version fingerprints, characterized in that: Includes the following steps: Obtain the dataset to be processed, construct a field lineage diagram, and calculate the normalized dependency degree using the field dependency formula and the normalized dependency formula; A subset of candidate desensitization strategies is matched for the field to be processed, and the strategies are simulated on randomly sampled samples. The risk of back identification and the risk reduction value are calculated, and the feasible strategy solution set is filtered out according to the preset risk threshold of back identification. The comprehensive score of the feasible strategy solution set is calculated using the utility retention formula, strategy matching formula, retrospective retention formula and comprehensive scoring formula to output the de-identification strategy matrix; The dataset to be processed is processed using the desensitization strategy matrix to generate an output batch summary. The desensitization strategy matrix summary is generated by combining the normalized dependency segmentation. The current stage version consistency fingerprint is obtained by combining each summary with the previous stage version consistency fingerprint using the stage fingerprint formula. The current stage record summary value is generated using the record summary formula. The reconstructed version consistency fingerprint obtained in the verification state is compared with the current stage version consistency fingerprint to output version drift information, triggering a multi-level response mechanism to control the data flow link and complete the evidence chain data desensitization. The steps for calculating the normalized dependency using the field dependency formula and the normalized dependency formula specifically include: Receive the dataset to be processed, as well as the processing context including field lineage mapping relationship, stage rule set, model parameter information, candidate desensitization strategy set, processing scenario and field type; Based on the field lineage mapping relationship, construct the field lineage graph containing original field nodes, intermediate field nodes, and derived field nodes; The field dependency is obtained by quantifying the absolute dependency of nodes using the aforementioned field dependency formula; Extract the minimum and maximum field dependency values, and use the normalized dependency formula to smooth and normalize the field dependency values ​​to obtain the normalized dependency value; The random sampling samples are extracted from the dataset to be processed according to a preset size, which is preset based on the computing power resources of the executing entity and the data distribution characteristics. The step of filtering and outputting a feasible strategy solution set based on a preset back-identification risk threshold specifically includes: For each of the fields to be processed, a subset of candidate de-identification strategies is selected from the set of candidate de-identification strategies based on the field type and the processing scenario; On the randomly sampled sample, each candidate desensitization strategy in the subset of candidate desensitization strategies is simulated and executed, and the re-identification risk is calculated using the re-identification risk formula. The baseline risk is received without desensitization processing, and the risk reduction value is calculated using the risk reduction value formula in conjunction with the back-identified risk. Verify whether the back identification risk is less than or equal to the back identification risk threshold, delete candidate de-identification strategies that do not meet the constraints, and output the remaining candidate de-identification strategies as the feasible strategy solution set; The risk threshold for back identification is preset based on privacy protection regulations and business tolerance in the application scenario; The step of calculating the comprehensive score of the feasible strategy solution set using the utility retention formula, strategy matching formula, retrospective retention formula, and comprehensive scoring formula to output the de-identification strategy matrix specifically includes: The utility retention value is calculated by evaluating each candidate desensitization strategy on the randomly sampled sample using the utility retention formula. The strategy matching value is calculated by evaluating each candidate de-identification strategy in the feasible strategy solution set using the strategy matching formula. Extract the normalized dependency, and calculate the trace retention value using the trace retention formula in combination with the feasible strategy solution set; The comprehensive score is calculated by integrating the risk reduction value, the utility retention value, the strategy matching value, and the retrospective retention value using the comprehensive scoring formula. The candidate desensitization strategy with the highest comprehensive score is selected as the target desensitization strategy combination to generate the desensitization strategy matrix.

2. The evidence chain desensitization method for fusing lineage constraints and version fingerprints according to claim 1, characterized in that, The step of processing the dataset to be processed using the desensitization strategy matrix to generate an output batch summary, and combining the normalized dependency segmentation to generate a desensitization strategy matrix summary, specifically includes: The desensitization strategy matrix is ​​used to perform desensitization algorithm operations on the dataset to be processed, generating a target dataset and the output batch summary. The target dataset serves as the final desensitization product of the current stage, and is output to external business processes or stored persistently. A high-granularity policy matrix summary is generated when the normalized dependency is greater than the high-risk threshold. A medium-granularity policy matrix summary is generated when the normalized dependency is less than or equal to the high-risk threshold and greater than or equal to the edge threshold. A low-granularity policy matrix summary is generated when the normalized dependency is less than the edge threshold. The integrated segmentation results are output as a summary of the desensitization strategy matrix; The high-risk threshold and the edge threshold are preset based on the data security level and the requirements for the granularity of audit traceability.

3. The evidence chain desensitization method based on the fusion of lineage constraints and version fingerprints as described in claim 2, characterized in that, The steps of combining each digest with the consistency fingerprint of the previous stage version using the stage fingerprint formula to obtain the consistency fingerprint of the current stage version, and generating the record digest value of the current stage using the record digest formula, specifically include: Generate a field lineage graph summary based on the field lineage graph, a rule version summary based on the stage rule set, and a model version summary based on the model parameter information; The current stage version consistency fingerprint is calculated by combining the stage fingerprint formula with a preset hash function, concatenating the field lineage graph summary, the rule version summary, the model version summary, the output batch summary, the desensitization strategy matrix summary, and the externally transmitted previous stage version consistency fingerprint. Construct a current stage record, write the current stage version consistency fingerprint and the digest value of the previous stage record passed from the outside into the current stage record, and calculate the current stage record digest value by using the record digest formula and the preset hash function.

4. The evidence chain desensitization method based on the fusion field lineage constraint and version fingerprint as described in claim 1, characterized in that, The step of comparing the reconstructed version consistency fingerprint obtained in the verification state with the current stage version consistency fingerprint and outputting version drift information specifically includes: Obtain the local rule version summary, local model version summary, local desensitization strategy matrix summary, and local lineage graph summary provided by the downstream execution environment as local summaries; The local summary is integrated with the output batch summary and the current stage version consistency fingerprint, and the stage fingerprint formula is used to perform a verification state calculation to obtain the reconstructed version consistency fingerprint. The reconstructed version consistency fingerprint is compared with the current stage version consistency fingerprint; When a mismatch occurs during the comparison, the local summary is compared with the corresponding ownership summary, and a difference summary and version drift information including policy drift, rule drift, model drift or lineage drift are output. The rights confirmation summary includes a rule version summary, a model version summary, a desensitization strategy matrix summary, and a field lineage graph summary.

5. The evidence chain desensitization method for fusing lineage constraints and version fingerprints according to claim 4, characterized in that, The steps for triggering the multi-level response mechanism to manage the data flow link specifically include: When the version drift information includes the policy drift, an upstream tracing call is triggered based on the current stage record summary value; The candidate de-identification strategy ranked second in the candidate strategy queue is extracted to replace the illegal loading strategy in the downstream environment. The candidate strategy queue is constructed in descending order based on the comprehensive score. After the replacement is completed, the verification state is re-executed to obtain the consistency fingerprint of the repaired reconstructed version. If the consistency fingerprint of the repaired reconstructed version can pass the comparison, the execution process is resumed.

6. The evidence chain desensitization method for fusing lineage constraints and version fingerprints according to claim 4, characterized in that, The steps for triggering the multi-level response mechanism to manage the data flow link specifically include: When the version drift information includes the rule drift or the model drift, the lineage node associated with the abnormal rule or abnormal model is reverse-mapped back to the field lineage graph as the lineage node that has an abnormality. A breadth-first search algorithm is used to delineate the cluster of derived nodes affected by the abnormal bloodline node and divide it into an affected subgraph; Intercept the underlying execution tasks related to the infected subgraph, divide the remaining topological branches in the field lineage graph into immune subgraphs, and allow the processing flow of the immune subgraphs.

7. The evidence chain desensitization method based on the fusion field lineage constraint and version fingerprint as described in claim 4, characterized in that, The steps for triggering the multi-level response mechanism to manage the data flow link specifically include: When the version drift information includes the lineage drift, the local new version lineage graph is obtained and the field lineage graph is compared with the structural features to extract the differential nodes and differential edges; The updated normalized dependency is recalculated for the affected and related nodes, including the differential nodes. The updated normalized dependency is substituted into the retrospective retention formula and the comprehensive scoring formula to calculate the updated comprehensive score; When the updated comprehensive score is greater than or equal to the preset safety and utility threshold, an exemption record is generated to allow passage. When the updated comprehensive score is less than the safety and utility threshold, an alarm signal is triggered and the execution process is blocked; The security and utility thresholds are pre-set based on the minimum acceptable risk-reward ratio of data anonymization services when facing changes in the underlying topology and the minimum retention threshold of downstream task indicators.

Images