A dynamic data desensitization method based on context awareness

Abstract

The present application relates to a kind of dynamic data desensitization methods based on context awareness, belong to computer data security and privacy protection technical field.The present application is by real-time data acquisition, business, calculates multidimensional context information and quantifies as standardization feature vector, and priority matches preset desensitization rule base;When rule matching degree is insufficient, select the closest desensitization rule;Again, according to the difference of computing engine type, desensitization strategy is embedded and executed;Finally, based on the execution log feedback optimization desensitization rule base, form adaptive closed loop.This method can realize the dynamic balance of desensitization protection and data value, cover whole-link sensitive information protection, and be deeply integrated with data processing flow, and have iterative optimization scene adaptability, effectively improve the accuracy and efficiency of sensitive data desensitization control.

Description

Technical Field

[0001] This invention belongs to the field of computer data security and privacy protection technology, specifically relating to a context-aware dynamic data desensitization method. Background Technology

[0002] In the current era of accelerated digital transformation, sectors such as healthcare, finance, government affairs, and the military are increasingly reliant on sensitive data. The need to both extract value through data analysis and meet the stringent privacy protection requirements of laws and regulations has created a growing contradiction between "data anonymization" and "value utilization." However, existing sensitive data anonymization solutions generally employ a "static preprocessing" model, which suffers from the following insurmountable technical flaws: First, the de-identification strategies are out of sync with the needs of different scenarios, leading to an imbalance between data value and security. Existing solutions typically de-identify data before it is stored in the storage system using fixed rules such as full-field masking and deletion of critical fields, and these rules remain unchanged for a long time once set. This static "de-identify first, process later" approach cannot adapt to the dynamic needs of different user roles and task objectives—either over-identification renders the data worthless for analysis, or insufficient de-identification leads to privacy leaks, making it difficult to achieve a balance between the two.

[0003] Secondly, there are blind spots in the protection of "derived sensitive information." Existing solutions can only identify and de-identify naturally existing sensitive fields such as ID card numbers, mobile phone numbers, and serial numbers, but cannot detect newly derived sensitive information generated during data processing through operations such as association, calculation, and aggregation. For example, in the military field, a combined query of "serial number + daily training duration" may reveal the combat readiness intensity of troops; in the financial field, the aggregate calculation of "account balance + transaction frequency" may deduce a user's income level. Because static solutions cannot monitor data flow and calculation logic, this kind of derived sensitive information cannot be dynamically identified and de-identified, easily becoming a security vulnerability and causing compliance risks.

[0004] Third, the de-identification control is disconnected from the data processing workflow, resulting in low adaptability and efficiency. Existing standalone de-identification systems and tools generally adopt an "add-on" deployment model, operating independently from mainstream data processing engines such as SQL engines and Spark / Flink. They cannot be deeply integrated into the data processing workflow and can only achieve coarse-grained de-identification at the data storage layer or access point. For example, when users execute complex SQL queries involving multi-table JOINs, these add-on tools are prone to two types of problems because they cannot parse the business logic and data relationships behind the query: first, they may cause incorrect de-identification of legitimate data analysis operations, affecting normal business operations; second, they may fail to effectively de-identify high-risk join calculation operations, leading to the leakage of sensitive information through join deduction. This makes it difficult to meet the fine-grained de-identification needs in complex data processing scenarios.

[0005] Fourth, it lacks adaptive optimization capabilities and struggles to cope with complex scenario changes. As business expands, the types of sensitive data and processing scenarios continue to increase. Existing solutions require frequent manual adjustments to desensitization rules and configurations, resulting in high maintenance costs, slow response times, and an inability to adapt to desensitization needs in new scenarios in a timely manner.

[0006] Therefore, existing static data anonymization solutions can no longer meet the needs of "dynamic adaptation, end-to-end protection, efficient collaboration, and iterative optimization" in digital scenarios. There is an urgent need for a new technical solution that can deeply integrate data processing workflows, perceive scene changes in real time, and accurately balance anonymization protection and data value. Summary of the Invention

[0007] (a) Technical problems to be solved The technical problem to be solved by this invention is how to provide a context-aware dynamic data desensitization method to solve the problems of "imbalance between security and value, blind spots in the protection of sensitive information, poor adaptability to data processing flow, and lack of adaptive optimization capability" in existing static data security management schemes.

[0008] (II) Technical Solution To address the aforementioned technical problems, this invention proposes a context-aware dynamic data anonymization method, which includes the following steps: S1. Contextual Information Quantification and Acquisition: After the user initiates a data processing request through the target data processing system, the target data processing system starts the contextual information quantification and acquisition process, which quantifies the current scene features through multi-dimensional information acquisition and generates a standardized feature vector. S2. Desensitization strategy decision based on quantified features: After obtaining the standardized feature vector, start the desensitization strategy decision process, perform desensitization rule matching, select the closest desensitization rule, verify the desensitization rule, and then output the standardized desensitization strategy instruction. S3. Real-time embedding and execution of de-identification strategies: After obtaining standardized de-identification strategy instructions, the strategy execution engine is automatically started. Through the computation link adaptation mechanism, the de-identification strategy is deeply embedded into the entire data processing process and executed in real time, and the de-identification results and execution logs are output. S4. Feedback optimization based on execution results: Domain experts manually formulate or modify rules in various preset libraries based on execution logs to achieve dynamic iterative optimization of the de-identification rule library; in addition, the validity of the de-identification rule library is regularly verified, and rules that have no matching scenarios for a long time, conflict with new regulations, or become invalid due to business changes are deleted or have their parameters adjusted to ensure the timeliness and accuracy of the de-identification rule library.

[0009] (III) Beneficial Effects This invention proposes a context-aware dynamic data anonymization method, which has the following advantages: 1. Achieve a dynamic balance between security and value. By sensing the multi-dimensional context of data, business, and computing in real time, dynamically adjust the strength of security policies to maximize the usable value of data while meeting compliance requirements.

[0010] 2. Comprehensive protection of sensitive information across the entire process. Breaking through the limitations of traditional technologies that can only process "raw sensitive fields," it accurately identifies and intercepts sensitive information generated during processing by analyzing the calculation logic and data flow path, eliminating blind spots in protection.

[0011] 3. Deep integration with data processing workflows. Abandoning the "plug-in" management model, the data anonymization strategy is embedded within the computing engine through operator-based design (such as operator adaptation for SQL / Spark / Flink). This avoids a disconnect between security and computational logic without increasing data processing latency. 4. Possesses self-optimizing scenario adaptability. Through an execution result feedback mechanism, it automatically iterates and optimizes the desensitization rule base, adapting to new sensitive types and business scenarios, reducing system maintenance costs, and improving the flexibility of long-term applications. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating the overall execution process of the present invention. Detailed Implementation

[0013] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0014] The technical problem to be solved by this invention is how to propose a context-aware dynamic data desensitization method to overcome the problems of "security and value imbalance, blind spots in the protection of derived sensitive information, poor adaptability to data processing flow, and lack of adaptive optimization capability" in existing static data security management schemes, so as to improve the dynamic adaptability of sensitive data security management, the integrity of the whole-link protection, and the utilization rate of data value.

[0015] Prerequisites: 1. It has a sensitive field library: built by domain experts in combination with business scenarios and compliance requirements, it stores the key quantitative parameters of core sensitive fields (including field weight, type coefficient, probability of occurrence alone, probability of occurrence in combination, and baseline value of associated leakage risk, etc.), supports precise / fuzzy matching, and can be manually maintained and updated; 2. It has a user permission database: built by the system administrator based on role responsibilities and confidentiality levels, storing fixed permission values ​​corresponding to each user role (the higher the permission level, the larger the permission value), and supporting real-time query by user account; 3. It has a task type risk database: built by domain experts based on the confidentiality of tasks and their business impact, storing fixed risk values ​​for various task types, and supporting real-time querying by the task type selected by the user; 4. It has an operation type risk database: built by domain experts based on the complexity of the operation and the strength of the data correlation, storing fixed risk values ​​corresponding to various data processing operations, and supporting real-time querying according to the operation type identified by the system; 5. Possesses a desensitization rule library: built by domain experts in combination with business scenario requirements, with several rules pre-stored, each rule corresponding to a unique scenario threshold vector (consistent with the dimension of the quantized feature vector). 6. Possesses a desensitization method library: Built by domain experts in combination with data characteristics and security requirements, it stores standardized desensitization processing rules (such as partial string masking, numerical Gaussian noise injection, etc.) corresponding to various types of sensitive data.

[0016] (1) Partial masking is used for string-type sensitive data:

[0017] Where N is the length of the original string S, a is the length of the first few characters to be retained, and b is the length of the last few characters to be retained. This is the processed string.

[0018] (2) Use interval fuzzy processing for numerically sensitive data:

[0019] in, These are the original values. The mean, Standard deviation This represents the processed numerical range.

[0020] The specific implementation steps proposed in this invention are as follows: S1. Contextual Information Quantification and Acquisition: After the user initiates a data processing request through the target data processing system, the target data processing system starts the contextual information quantification and acquisition process. This process quantifies the current scene features through multi-dimensional information acquisition and generates a standardized feature vector. The specific steps are as follows: S11. Data Context Acquisition and Quantification: After receiving a user's data processing request, the system uses a sensitive field library (defined in the prerequisite description) to match and classify sensitive fields in the requested data, directly locating sensitive fields in the current data by matching field names. To measure data sensitivity, we introduce a data sensitivity score. The specific calculation method is as follows: (1) in, The weight of the i-th sensitive field (the weight preset in the sensitive field library); Risk of data leakage due to field association ( ),in This represents the joint probability of n sensitive fields appearing simultaneously. This represents the probability of the i-th sensitive field appearing alone (i = 1, 2, ..., n).

[0021] The above calculations can transform the sensitivity of data into a quantitative indicator, providing a data dimension basis for subsequent desensitization strategy decisions.

[0022] S12. Business Context Collection and Quantification: The system queries the user permission database in real time through user accounts (see the definition in the preset prerequisites) to directly obtain the fixed permission values ​​corresponding to the user role. Based on the task type selected by the user when initiating the request, the system queries the task type risk database (see the definition in the preset instructions) to obtain the corresponding fixed risk value. .

[0023] Through the above quantitative calculations, user permissions and task risks are transformed into calculable indicators, providing a business dimension basis for the accurate matching of subsequent de-identification strategies.

[0024] S13. Computational Context Acquisition and Quantization: After identifying the operation type corresponding to the user's data processing request, the system queries the operation type risk database (see the definition in the preset instructions) to obtain the corresponding fixed risk value. .

[0025] Through the above quantitative operations, the risks of data processing operations are transformed into quantifiable indicators, providing a computational dimension for the dynamic adaptation of subsequent de-identification strategies.

[0026] S14. Generate standardized feature vectors: The system will generate the data sensitivity score obtained in S11. User permission values ​​obtained by S12 Risk value related to task type The risk value of the operation type obtained in S13 Combined into a standardized feature vector , which serves as the input to S2.

[0027] S2. Desensitization strategy decision based on quantified features: obtaining standardized feature vectors Then, the desensitization strategy decision-making process is initiated, desensitization rules are matched, the closest desensitization rule is selected, the desensitization rule is verified, and then standardized desensitization strategy instructions are output. The specific steps are as follows: S21. Masking Rule Matching: The preset masking rule library (see the definition in the preset description) is built by domain experts in combination with business scenario requirements. The library contains several pre-stored rules, and each rule corresponds to a unique scenario threshold vector. , where i is the rule number. The dimension is consistent with the standardized feature vector X. After receiving the quantized feature vector X output by S14, the system uses X to match the corresponding dimension of each rule in the rule base. Calculate the matching degree one by one This is used to determine the degree of fit between the current scene and the rules. The matching degree is calculated using cosine similarity (cosine similarity). The closer it is to 1, the better X is to The higher the compatibility, the better. The formula is as follows: (2) in, Let j be the j-th eigenvalue in the eigenvector X output by S14; The threshold vector corresponding to the i-th rule The j-th value; , They are vectors X and X, respectively. The length of the module.

[0028] The system iterates through all rules in the rule base and completes the relationship between X and each rule. After calculating the matching degree, select those that meet the requirements. Rules with a threshold value greater than or equal to a preset threshold (e.g., 0.8) are added to the candidate rule set to provide a basis for subsequent policy invocation.

[0029] S22. Selection of the closest desensitization rule: When the set of candidate rules selected in S21 is empty (i.e., no rule satisfies the matching degree) This process is triggered when the threshold value is greater than or equal to the preset threshold. The system selects rules from all de-identification rules in the de-identification rule library that match the feature vector X output by S14. The largest rule is taken as the "closest desensitization rule"; the desensitization strategy corresponding to this rule is directly used to perform the desensitization operation (i.e., directly jump to S3); at the same time, this scenario is marked (for subsequent log recording "X does not match the threshold vector of the desensitization rule, so the closest desensitization rule is used").

[0030] S23. Desensitization rule verification: When the number of rules in the candidate rule set obtained in S21 is ≥2, the verification process of this strategy is started; if the candidate rule set contains only 1 rule, this process is skipped directly and the desensitization strategy corresponding to that rule is adopted.

[0031] S231. Loss rate calculation: For each de-identification rule in the candidate de-identification rule set, calculate its corresponding data value loss rate L.

[0032] First, we design a Quality Decay Coefficient (QDC) to measure the value of the data, and its calculation method is as follows: (3) in, A higher value indicates higher data quality. is the weight of the i-th key field (consistent with the weight of the i-th sensitive field in S11) , and k is the number of sensitive fields covered by the current data processing request; The desensitization strength coefficient for the corresponding data type is preset for the desensitization rule (provided by the preset desensitization rule library).

[0033] Secondly, the data value loss rate L is calculated based on QDC: (4) in, The information value of the original data, i.e., the QDC when no de-identification strategy is implemented. The value of the data information after implementing the de-identification strategy corresponding to this rule is the QDC corresponding to this rule.

[0034] S232. Selecting the optimal desensitization strategy: The system compares the loss rate L corresponding to all rules in the candidate desensitization rule set and selects the desensitization strategy corresponding to the rule with the smallest L as the final candidate desensitization strategy.

[0035] S24. Output standardized desensitization strategy instructions: The qualified security strategy, i.e. the optimal strategy that meets the data value loss rate threshold requirement, is encapsulated into standardized execution instructions and used as input parameters for S3.

[0036] S3. Real-time embedding and execution of de-identification strategies: After obtaining standardized de-identification strategy instructions, the strategy execution engine is automatically started. Through the computation link adaptation mechanism, the de-identification strategy is deeply embedded into the entire data processing process and executed in real time, and the de-identification results and execution logs are output.

[0037] The specific steps are as follows: S31. Computation Engine Adaptation: For the types of computing engines relied upon by data processing tasks, the system employs differentiated adaptation schemes for SQL engines and Spark / Flink, precisely embedding the security policy execution logic into the corresponding engine's processing chain. (1) For SQL processing tasks, the engine optimizer plugin automatically inserts security processing operators during the SQL execution plan generation stage, so that the security control logic is deeply integrated with the data query process; (2) For Spark / Flink-based stream processing tasks, customized operators are used to implement policy interception and execution in the data flow chain to ensure that security control is embedded without delay in real-time data processing scenarios.

[0038] S32. Desensitization Strategy Execution: Based on the type of the current data, call the corresponding standardized processing rules in the preset desensitization method library (see the definition in the preset description) to complete the desensitization operation of sensitive data.

[0039] S33. Output de-identification results and execution log: Return the de-identified data to the user, and simultaneously generate an execution log containing elements such as the complete content of the strategy, actual execution details, and sensitive information processing results (including the marking description of the S22 scenario). This log will serve as the basis for subsequent optimization of de-identification rules and strategies by domain experts.

[0040] S4. Feedback optimization based on execution results: Domain experts manually formulate or modify rules in various preset libraries based on execution logs to achieve dynamic iterative optimization of the de-identification rule library; in addition, the validity of the de-identification rule library is regularly verified, and rules that have no matching scenarios for a long time, conflict with new regulations, or become invalid due to business changes are deleted or have their parameters adjusted to ensure the timeliness and accuracy of the de-identification rule library.

[0041] Example 1: A user (user account: ZM-00123) initiated a "XX Deployment Basic Data Query" task through the target data processing system. The query content includes string fields (number, device model) and numeric fields (number of deployed personnel) for internal analysis.

[0042] Disclaimer: The user accounts, IDs, device models, and number of deployed users mentioned here are fictitious and are used only as examples in this embodiment. It is also assumed that the following core libraries have been established by experts: Table 1 Sensitive Field Library

[0043] Table 2 User Permissions Database

[0044] Table 3 Task Type Risk Database

[0045] Table 4 Operation Type Risk Database

[0046] Table 5 Desensitization Rule Base

[0047] Table 6 Matching Degree Library

[0048] The execution flow of this invention is as follows: Figure 1 As shown, the specific steps are as follows: S1. After a user initiates a data query, the system collects information from four dimensions: "sensitive fields, user permissions, task type, and operation type," and converts it into a quantitative feature vector to prepare for subsequent matching of desensitization rules.

[0049] S11. The system first matches sensitive fields in the request, then calculates the associated leakage risk of these fields, and finally obtains a data sensitivity score. The system matches three sensitive fields in the request (ID, device model, and number of deployed personnel), obtains the individual and combined occurrence probabilities of the three sensitive fields from the sensitive field database (Table 1), and calculates the associated leakage risk. The sensitivity was then obtained through calculation. .

[0050] S12. The system obtains the corresponding permissions and risk quantification values ​​based on user accounts and task types. The system calculates the permission values ​​for the "Administrator 1" role based on the user permission database (Table 2) and the task type risk database (Table 3). The risk value for the "Deployment Data Query" task type is obtained. .

[0051] S13. The system identifies the current operation type and obtains the corresponding operation risk quantification value. The system obtains the "single table query" risk value based on the operation type risk database (Table 4). .

[0052] S14. The system combines the four quantized values ​​obtained from S11-S13 into a feature vector. As input to S2.

[0053] S2. The system uses the feature vector of S14 to match the rules in the desensitization rule base, filters out the suitable rules, and selects the optimal strategy through loss rate calculation.

[0054] S21. The system calculates the "cosine similarity" between the feature vector X and the threshold vector of each rule in the desensitization rule base (Table 5) and selects the appropriate rules.

[0055] Based on rule 1, substituting the values ​​of X and R1, the cosine similarity formula is used to calculate:

[0056] Based on rule 2, substituting the values ​​of X and R2, the cosine similarity formula is used to calculate:

[0057] Since the matching threshold M is set to 0.8 (obtained from table 6 of the matching database), both rule 1 and rule 2 are selected into the candidate rule set.

[0058] S22. Skip this step because the number of candidate desensitization strategies is greater than or equal to 2.

[0059] S23. The system calculates the "data value loss rate L" for the candidate de-identification rules and selects the rule with the lowest loss rate.

[0060] S231. First, measure the value of the anonymized data using the "Data Quality Degradation Coefficient (QDC)," then calculate the loss rate. The original data value is then calculated. .

[0061] Next, calculate the data value loss for Rule 1 by substituting the data from the anonymization strategy library (Table 5):

[0062] This leads to the data loss rate of Rule 1.

[0063] Next, calculate the data value loss under rule 2 by substituting the data from the anonymization strategy library (Table 5):

[0064] This leads to the data loss rate in Rule 2.

[0065] S232. Compare the loss rates of the two rules. Therefore, the desensitization strategy corresponding to rule 1 is selected.

[0066] S24. The verified de-identification strategy, i.e. the optimal strategy that meets the data value loss rate threshold requirement, is encapsulated into a standardized execution instruction and used as the input parameter of S3.

[0067] S3. After receiving the standardized de-identification strategy output by S24, the system automatically starts the strategy execution engine. Through the computation link adaptation mechanism, the de-identification strategy is deeply embedded into the entire data processing flow and executed in real time. The specific steps are as follows: S31. In this embodiment, the SQL engine is used as an example to process query tasks. During the SQL execution plan generation stage, de-identification operators (string part masking operator and numerical range fuzzy operator) are automatically inserted.

[0068] S32. The system performs corresponding de-identification operations for each sensitive field: Number (original value: "12345", string): Execute "Partial Mask (keep first 3 characters and last 1 character)" → Result: "123 5”; Device model (original value: "ABC-12A", string): Execute "Partial Mask (keep first 3 bits and last 1 bit)" → Result: "ABC- A”; Number of deployed personnel (original value: "520", numerical type): Substituting μ=10 and σ=10 from rule 1, the execution interval is fuzzy: [x+μ σ,x+μ+σ]=[520+10 10,520+10+10]=[520,540] S33. The system returns the anonymized data and generates a log containing anonymization details. The anonymization result is returned to the user: number "123". 5”, Equipment model “ABC- A", the number of deployed users is "520-540"; and the following execution log is generated: Table 10 Execution Log

[0069] S4 receives the execution log output by S33. Domain experts can manually formulate or modify rules in various preset libraries based on the log to achieve dynamic iterative optimization of the de-identification rule library. In addition, the de-identification rule library (see Table 5) is validated regularly. For rules that have no matching scenarios for a long time, conflict with new regulations, or become invalid due to business changes, deletion or parameter adjustment operations are performed to ensure the timeliness and accuracy of the de-identification rule library.

[0070] Example 2: A context-aware dynamic data anonymization method includes the following steps: S1. Contextual Information Quantification Collection: After a user initiates a data processing request, the system collects contextual information in the data dimension, business dimension, and computation dimension, and converts it into a standardized feature vector. S2. Desensitization strategy decision based on quantified features: Using the standardized feature vector as input, match the preset desensitization rule library and select the optimal desensitization strategy; S3. Real-time embedding and execution of the de-identification strategy: Based on the type of computing engine that the data processing task depends on, the optimal de-identification strategy is embedded into the data processing flow and the de-identification operation is executed. S4. Feedback optimization based on execution results: Collect de-identification execution logs and iteratively optimize the preset de-identification rule base.

[0071] Step S1 specifically includes: S11. Data Context Collection and Quantification: Based on a preset sensitive field library, sensitive fields are matched, and data sensitivity scores are calculated. S12. Business Context Collection and Quantification: Query the preset user permission library and preset task type risk library to obtain user permission values ​​and task risk values; S13. Calculation Context Acquisition and Quantification: Query the preset operation type risk library to obtain the operation risk value; S14. Generate standardized feature vector: Combine data sensitivity score, user permission value, task risk value, and operational risk value into a standardized feature vector.

[0072] In step S11, the data sensitivity score is calculated as follows:

[0073] in, The weight of the i-th sensitive field (the weight preset in the sensitive field library); Risk of data leakage due to field association ( ),in This represents the joint probability of n sensitive fields appearing simultaneously. This represents the probability of the i-th sensitive field appearing alone (i = 1, 2, ..., n).

[0074] Step S2 specifically includes: S21. Desensitization rule matching: Perform cosine similarity matching between the standardized feature vector and the scene threshold vector of the preset desensitization rule library, and filter out candidate rules with a matching degree ≥ preset threshold. S22. Selection of the closest rule: If the candidate rule set is empty, select the closest de-identification rule with the highest matching degree; S23. De-identification rule verification: If the number of candidate rules is ≥2, the optimal rule is selected by calculating the data value loss rate. S24. Output standardized desensitization strategy instructions: Encapsulate the optimal desensitization strategy into execution instructions.

[0075] In step S23, the calculation of the data value loss rate depends on the data quality decay coefficient QDC, and the calculation method is as follows:

[0076] in, The desensitization intensity coefficient; Data value loss rate ,in, The information value of the original data. The value of the data information after implementing the de-identification strategy corresponding to this rule.

[0077] Step S3 specifically includes: S31. Computation Engine Adaptation: For the SQL engine, anonymize operators are inserted during the execution plan generation phase; for the Spark / Flink streaming engine, data is intercepted and executed using customized operators. S32. Desensitization strategy execution: Call the preset desensitization method library to perform corresponding desensitization operations on different types of data; S33. Output de-identification results and execution log: Return the de-identified data and generate an execution log containing strategy details.

[0078] In step S32, interval fuzzy processing is applied to numerically sensitive data. The processing method is as follows:

[0079] in, These are the original values. The mean, Standard deviation This represents the processed numerical range.

[0080] In step S4, the feedback optimization includes: iteratively updating the preset desensitization rule base based on the execution log, and periodically verifying and adjusting invalid or conflicting rules in the rule base.

[0081] Example 3: To address the aforementioned technical problems, this invention proposes a context-aware dynamic data anonymization method, which specifically includes the following steps: Step 1: Quantitative Collection of Contextual Information: During the execution of the data processing task, contextual information of data (sensitive fields), business (user roles, task objectives), and calculation (processing logic) dimensions is collected in real time and transformed into standardized feature vectors through a quantization model.

[0082] Step 2: Security policy decision based on quantified features: Using feature vectors as input, prioritize matching the preset rule base; if the matching degree does not reach the threshold, call the machine learning model to dynamically generate a fine-grained security policy adapted to the current scenario.

[0083] Step 3: Real-time embedding and execution of de-identification strategies: Based on the type of computing engine that the task depends on, a differentiated approach is adopted to embed the de-identification strategy into the data processing flow.

[0084] Step 4: Feedback optimization based on execution results: Collect strategy execution logs, iteratively optimize the de-identification rule base, improve the accuracy of de-identification strategy decisions for subsequent scenarios, and form an adaptive optimization closed loop.

[0085] This invention discloses a context-aware dynamic data anonymization method, belonging to the field of computer data security and privacy protection technology. Addressing the shortcomings of existing static anonymization schemes, this method collects multi-dimensional contextual information from data, business processes, and computations in real time and quantifies it into standardized feature vectors. It prioritizes matching with a pre-set anonymization rule library; when rule matching is insufficient, it selects the closest anonymization rule; then, it embeds and executes anonymization strategies based on differences in computation engine type; finally, it optimizes the anonymization rule library based on execution log feedback, forming an adaptive closed loop. This method achieves a dynamic balance between anonymization protection and data value, covers the entire chain of sensitive information protection, deeply integrates with data processing workflows, and has iterative optimization adaptability, effectively improving the accuracy and efficiency of sensitive data anonymization control.

[0086] This invention proposes a context-aware dynamic data anonymization method, which has the following beneficial effects: 1. Achieve a dynamic balance between security and value. By sensing the multi-dimensional context of data, business, and computing in real time, dynamically adjust the strength of security policies to maximize the usable value of data while meeting compliance requirements.

[0087] 2. Comprehensive protection of sensitive information across the entire process. Breaking through the limitations of traditional technologies that can only process "raw sensitive fields," it accurately identifies and intercepts sensitive information generated during processing by analyzing the calculation logic and data flow path, eliminating blind spots in protection.

[0088] 3. Deep integration with data processing workflows. Abandoning the "plug-in" management model, the data anonymization strategy is embedded within the computing engine through operator-based design (such as operator adaptation for SQL / Spark / Flink). This avoids a disconnect between security and computational logic without increasing data processing latency. 4. Possesses self-optimizing scenario adaptability. Through an execution result feedback mechanism, it automatically iterates and optimizes the desensitization rule base, adapting to new sensitive types and business scenarios, reducing system maintenance costs, and improving the flexibility of long-term applications.

[0089] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A context-aware dynamic data anonymization method, characterized in that, The method includes the following steps: S1. Contextual Information Quantification and Acquisition: After the user initiates a data processing request through the target data processing system, the target data processing system starts the contextual information quantification and acquisition process, which quantifies the current scene features through multi-dimensional information acquisition and generates a standardized feature vector. S2. Desensitization strategy decision based on quantified features: After obtaining the standardized feature vector, start the desensitization strategy decision process, perform desensitization rule matching, select the closest desensitization rule, verify the desensitization rule, and then output the standardized desensitization strategy instruction. S3. Real-time embedding and execution of de-identification strategies: After obtaining standardized de-identification strategy instructions, the strategy execution engine is automatically started. Through the computation link adaptation mechanism, the de-identification strategy is deeply embedded into the entire data processing process and executed in real time, and the de-identification results and execution logs are output. S4. Feedback optimization based on execution results: Domain experts manually formulate or modify rules in various preset libraries based on execution logs to achieve dynamic iterative optimization of the de-identification rule library; in addition, the validity of the de-identification rule library is regularly verified, and rules that have no matching scenarios for a long time, conflict with new regulations, or become invalid due to business changes are deleted or have their parameters adjusted to ensure the timeliness and accuracy of the de-identification rule library.

2. The context-aware dynamic data anonymization method as described in claim 1, characterized in that, This method pre-constructs a sensitive field library, a user permission library, a task type risk library, an operation type risk library, a de-identification rule library, and a de-identification method library; It has a sensitive field library: built by domain experts in combination with business scenarios and compliance requirements, storing key quantitative parameters of core sensitive fields, including: field weight, type coefficient, probability of occurrence alone, probability of occurrence in combination, and baseline value of associated leakage risk; User permission library: Built by the system administrator based on role responsibilities and confidentiality level, it stores fixed permission values ​​corresponding to each user role and supports real-time query by user account; Task Type Risk Library: Built by domain experts based on the confidentiality level and business impact of tasks, it stores fixed risk values ​​corresponding to various task types and supports real-time querying by the task type selected by the user. Operation Type Risk Library: Built by domain experts based on operation complexity and data correlation strength, it stores fixed risk values ​​corresponding to various data processing operations and supports real-time querying by operation type identified by the system. The desensitization rule library is built by domain experts in combination with business scenario requirements. It pre-stores several rules, and each rule corresponds to a unique scenario threshold vector. Desensitization Method Library: Built by domain experts in combination with data characteristics and security requirements, it stores standardized desensitization rules for various types of sensitive data.

3. The context-aware dynamic data anonymization method as described in claim 1 or 2, characterized in that, S1 includes: S11. Data Context Acquisition and Quantification: After receiving a user's data processing request, the system uses a sensitive field database to match and classify sensitive fields in the requested data, directly locating sensitive fields in the current data by matching field names. To measure the sensitivity of the data, a data sensitivity score is introduced. This transforms the sensitivity of data into quantitative indicators. S12. Business Context Collection and Quantification: The system queries the user permission database in real time through user accounts to directly obtain the fixed permission values ​​corresponding to the user role. Based on the task type selected by the user when initiating the request, the system queries the task type risk database to obtain the corresponding fixed risk value. Through the above quantitative calculations, user permissions and task risks are transformed into calculable indicators. S13. Computational Context Acquisition and Quantization: After identifying the operation type corresponding to the user's data processing request, the system queries the operation type risk database to obtain the corresponding fixed risk value. Through the above quantitative operations, the risks of data processing operations are transformed into quantifiable indicators. S14. Generate standardized feature vectors: The system will generate the data sensitivity score obtained in S11. User permission values ​​obtained by S12 Risk value related to task type The risk value of the operation type obtained in S13 Combined into a standardized feature vector .

4. The context-aware dynamic data anonymization method as described in claim 3, characterized in that, Data sensitivity score The specific calculation method is as follows: (1) in, Let be the weight of the i-th sensitive field; To mitigate the risk of data leakage due to field associations, ,in This represents the joint probability of n sensitive fields appearing simultaneously. This represents the probability of the i-th sensitive field appearing alone (i = 1, 2, ..., n).

5. The context-aware dynamic data anonymization method as described in claim 3, characterized in that, S2 includes: S21. Masking Rule Matching: A pre-built masking rule library is constructed by domain experts based on business scenario requirements. The library contains several pre-stored rules, each corresponding to a unique scenario threshold vector. , where i is the rule number. The dimension of X is consistent with that of the standardized feature vector X; the system uses X to match the dimension of each rule in the rule base. The matching degree is calculated one by one to determine the degree of fit between the current scene and the rule. The system iterates through all rules in the rule base and completes the relationship between X and each rule. After calculating the matching degree, select those that meet the requirements. Rules that exceed or exceed a preset threshold are added to the candidate rule set to provide a basis for subsequent policy invocation; S22. Selection of the closest desensitization rule: When the set of candidate rules selected in S21 is empty, that is, no rule satisfies the matching degree. When the value is greater than or equal to the preset threshold, this process is triggered: The system selects the rules that match the feature vector X output by S14 from all de-identification rules in the de-identification rule library. The largest rule is designated as the "closest desensitization rule"; the desensitization strategy corresponding to this rule is directly applied to perform the desensitization operation, and the process jumps to S3; at the same time, this scenario is marked for subsequent logging. S23. De-identification rule verification: When the number of rules in the candidate rule set obtained in S21 is ≥2, the verification process of this strategy is started; if the candidate rule set contains only 1 rule, this process is skipped directly and the de-identification strategy corresponding to that rule is adopted. S24. Output standardized desensitization strategy instructions: The qualified security strategy, i.e. the optimal strategy that meets the data value loss rate threshold requirement, is encapsulated into standardized execution instructions and used as input parameters for S3.

6. The context-aware dynamic data anonymization method as described in claim 5, characterized in that, In step S21, the matching degree is calculated using cosine similarity. The closer it is to 1, the better X is to The higher the compatibility, the better, as shown in the formula below: (2) in, Let J be the j-th eigenvalue in the standardized eigenvector X; The threshold vector corresponding to the i-th rule The j-th value; , They are vectors X and X, respectively. The length of the module.

7. The context-aware dynamic data anonymization method as described in claim 5, characterized in that, S23 includes: S231. Loss rate calculation: For each de-identification rule in the candidate de-identification rule set, calculate its corresponding data value loss rate L. First, a data quality degradation coefficient (QDC) is designed to measure the value of data, and its calculation method is as follows: (3) in, A higher value indicates higher data quality. Let k be the weight of the i-th key field, and k be the number of sensitive fields covered by the current data processing request. The desensitization strength coefficients for the corresponding data types preset for the desensitization rules are provided by the preset desensitization rule library; Secondly, the data value loss rate L is calculated based on QDC: (4) in, The information value of the original data, i.e., the QDC when no de-identification strategy is implemented. The value of the data information after implementing the de-identification strategy corresponding to this rule, i.e., the QDC corresponding to this rule; S232. Selecting the optimal desensitization strategy: The system compares the loss rate L corresponding to all rules in the candidate desensitization rule set and selects the desensitization strategy corresponding to the rule with the smallest L as the final candidate desensitization strategy.

8. The context-aware dynamic data anonymization method as described in claim 5, characterized in that, S3 includes: S31. Computation Engine Adaptation: For the types of computing engines relied upon by data processing tasks, the system employs differentiated adaptation schemes for SQL engines and Spark / Flink, precisely embedding the security policy execution logic into the corresponding engine's processing chain. S32. Desensitization strategy execution: Based on the type of the current data, call the corresponding standardized processing rules in the preset desensitization method library to complete the desensitization operation of sensitive data; S33. Output de-identification results and execution log: Return the de-identified data to the user, and simultaneously generate an execution log containing the complete content of the strategy, actual execution details, and the results of sensitive information processing. This log will serve as the basis for subsequent optimization of de-identification rules and strategies by domain experts.

9. The context-aware dynamic data anonymization method as described in claim 8, characterized in that, S31 includes: For SQL-type processing tasks, the engine optimizer plugin automatically inserts security processing operators during the SQL execution plan generation stage, enabling deep integration of security control logic with the data query process; For Spark / Flink-based stream processing tasks, customized operators are used to implement policy interception and execution in the data flow chain, ensuring that security control is embedded without delay in real-time data processing scenarios.

10. The context-aware dynamic data anonymization method as described in claim 8, characterized in that, The desensitization rules in the desensitization method library include: (1) Partial masking is used for string-type sensitive data: Where N is the length of the original string S, a is the length of the first few characters to be retained, and b is the length of the last few characters to be retained. The processed string; (2) Use interval fuzzy processing for numerically sensitive data: in, These are the original values. The mean, Standard deviation This represents the processed numerical range.

Images