Data desensitization and restoration method and device in a payment system, electronic equipment and storage medium
By employing dynamic data anonymization methods, generative adversarial neural networks, deep neural networks, and large language models to process structured and unstructured data in payment systems, the problem of static anonymization affecting business logic and consuming large amounts of resources is solved, achieving efficient and secure data anonymization and restoration.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- FUJIAN GOTOP XINGYI NETWORK TECH
- Filing Date
- 2025-12-03
- Publication Date
- 2026-07-10
AI Technical Summary
Existing data anonymization methods in payment systems suffer from static anonymization, which impacts business logic and consumes significant resources. They are also difficult to adapt to adaptive anonymization for different scenarios and types, especially for text-based order data and product video and photo data.
A dynamic desensitization method based on data type, data desensitization and restoration identifier, and usage scenario is adopted. Generative adversarial neural networks, deep neural networks, and large language models are used for sensitive detection and processing of structured and unstructured data. Homomorphic encryption algorithms and format-preserving encryption technology are combined to achieve dynamic desensitization and reversible restoration of data.
It improves the efficiency and security of data anonymization, adapts to the needs of different application scenarios, ensures maximum data confidentiality, and improves efficiency during data restoration.
Smart Images
Figure CN122365552A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data desensitization technology in e-commerce systems, specifically to a data desensitization and restoration method, apparatus, electronic device, and storage medium in a payment system. Background Technology
[0002] In the digital economy era, with the rapid development of e-commerce systems, data security and privacy protection within these systems have become a global focus. Data anonymization, also known as data de-identification or desensitization, refers to technical means of transforming or modifying sensitive data according to given strategies and rules to prevent sensitive data from being used in unreliable environments or by unauthorized personnel for abnormal business purposes. For example, it can prevent unauthorized personnel from illegally accessing payment systems.
[0003] In existing technologies, data in payment systems, such as transaction data and payment data, are mostly anonymized using static methods. Batch data processing permanently changes data values, which is irreversible, affects business logic, and consumes a large amount of system resources.
[0004] The dynamic anonymization of transaction data in existing payment systems is insufficient to meet the needs of anonymizing large amounts of transaction data, and it cannot adapt to adaptive anonymization for different scenarios and types of data, such as text-based order data and video / photo data of goods. Summary of the Invention
[0005] In view of one or more technical defects in the prior art, the present invention proposes the following technical solution.
[0006] A data anonymization method in a payment system, the method comprising: The receiving step is used to receive a data desensitization instruction input by a user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The data desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. The judgment step involves retrieving the data object to be desensitized from the database based on the data desensitization instruction, determining the data type of the data object to be desensitized, and identifying whether the data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata, which includes at least one second data field. The unstructured data includes images or videos of products. De-identification steps: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified, and the data usage scenario, the data object to be de-identified is processed, and the resulting de-identified data is sent to the user. The de-identified data includes the data de-identification and restoration identifier.
[0007] Furthermore, in the desensitization step: if the data usage scenario is a neural network training sample generation scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, when the data type is unstructured data, the data object to be desensitized is input into the trained generative adversarial neural network model to generate desensitized data, and a large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated desensitized data and the desensitized metadata are sent to the user together. When the data type is structured data, the large language model is used to perform sensitivity detection on the first data field in the data table to obtain the sensitive field, and the content in the data table corresponding to the sensitive field is subjected to the first desensitization process to obtain desensitized data, which is then sent to the user.
[0008] Furthermore, the first desensitization process is as follows: using the large language model to analyze and process the content of the data table corresponding to the sensitive field, obtaining the grammatical format of the content of the data table corresponding to each sensitive field, generating virtual content corresponding to each sensitive field based on the grammatical format using the large language model, and using the virtual content to replace the content of the data table corresponding to the sensitive field to obtain the desensitized data.
[0009] Furthermore, in the de-identification step: if the data usage scenario is a user query scenario and the data de-identification and restoration identifier indicates that the de-identified data cannot be restored to the original data, the user's query permission is obtained. When the data type is unstructured data, a data range corresponding to the user's query permission is extracted from the unstructured data. A query image or video is generated based on the data range, and the large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed de-identified metadata. The generated query image or video and the de-identified metadata are sent to the user together. When the data type is structured data, the content of the data table corresponding to the query permission is obtained to generate a user query data table as the de-identified data.
[0010] Furthermore, the operation of obtaining the content of the data table corresponding to the query permission to generate the user query data table includes: a query agent program deployed between the user and the database obtains the user's SQL query instruction for the data, the SQL query instruction including query conditions; the query agent program rewrites the query conditions based on the user's permissions and the de-identification strategy to generate a new SQL query instruction; and the query agent program sends the new SQL query instruction to the database to query and obtain the de-identified data. The correspondence between user permissions and de-identification strategies can be stored using a relational table, and different de-identification strategies corresponding to different user permissions can be obtained by looking up the table.
[0011] Furthermore, in the desensitization step: if the data usage scenario is a data transmission scenario and the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, when the data type is unstructured data, a trained deep neural network model is used to detect sensitive parts in the unstructured data, the unstructured data is divided into sensitive and non-sensitive parts, the sensitive parts are encrypted using format-preserving encryption technology, and the second data field in the metadata is sensitively detected using the large language model. If the second data field is a sensitive field, the second data field is encrypted using tokenization technology to obtain encrypted metadata. The non-sensitive part, the encrypted sensitive part, and the encrypted metadata are sent together to the user. When the data type is structured data, the structured data is encrypted using a homomorphic encryption algorithm and used as the desensitized data.
[0012] Furthermore, the operation of encrypting the sensitive portion using format-preserving encryption technology involves: obtaining the R, G, and B values of each pixel in the sensitive portion and performing the following operations on them: , where [ ] represents rounding calculation, mod represents modulo calculation, and the calculated f(R), f(G), f(B) are used to replace the original R, G, B values to obtain the decrypted sensitive part.
[0013] This invention also proposes a method for restoring de-identified data generated using the data de-identification method described above in the payment system, the method comprising: The acquisition step involves acquiring the de-identified data submitted by the user to be restored, which is generated using the data de-identification method described above in the payment system. The detection step involves detecting the data desensitization and restoration identifier in the desensitized data. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, a prompt message indicating that it cannot be restored is sent to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, the data type of the desensitized data is determined. The restoration step involves, if the data type is structured data, using the decryption algorithm corresponding to the homomorphic encryption algorithm to decrypt the anonymized data to obtain restored data, which is then sent to the user. If the data type is unstructured data, the encrypted sensitive portion and encrypted metadata are extracted from the anonymized data. For the encrypted sensitive portion: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
[0014] The present invention also proposes a data anonymization device for a payment system, the device comprising: The receiving unit is used to receive a data desensitization instruction input by the user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The data desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. The judgment unit retrieves the data object to be desensitized from the database based on the data desensitization instruction, and determines the data type of the data object to be desensitized. The data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata. The metadata includes at least one second data field. The unstructured data includes images or videos of products. De-identification unit: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified, and the data usage scenario, the de-identified data is processed and sent to the user. The de-identified data includes the data de-identification and restoration identifier.
[0015] Furthermore, in the desensitization unit: if the data usage scenario is a neural network training sample generation scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, when the data type is unstructured data, the data object to be desensitized is input into the trained generative adversarial neural network model to generate desensitized data, and a large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated desensitized data and the desensitized metadata are sent to the user together. When the data type is structured data, the large language model is used to perform sensitivity detection on the first data field in the data table to obtain the sensitive field, and the content in the data table corresponding to the sensitive field is subjected to the first desensitization process to obtain desensitized data, which is then sent to the user.
[0016] Furthermore, the first desensitization process is as follows: using the large language model to analyze and process the content of the data table corresponding to the sensitive field, obtaining the grammatical format of the content of the data table corresponding to each sensitive field, generating virtual content corresponding to each sensitive field based on the grammatical format using the large language model, and using the virtual content to replace the content of the data table corresponding to the sensitive field to obtain the desensitized data.
[0017] Furthermore, in the de-identification unit: if the data usage scenario is a user query scenario and the data de-identification and restoration identifier indicates that the de-identified data cannot be restored to the original data, the user's query permission is obtained. When the data type is unstructured data, a data range corresponding to the user's query permission is extracted from the unstructured data. A query image or video is generated based on the data range, and the large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed de-identified metadata. The generated query image or video and the de-identified metadata are sent to the user together. When the data type is structured data, the content of the data table corresponding to the query permission is obtained to generate a user query data table as the de-identified data.
[0018] Furthermore, the operation of obtaining the content of the data table corresponding to the query permission to generate the user query data table includes: a query agent program deployed between the user and the database obtains the user's SQL query instruction for the data, the SQL query instruction including query conditions; the query agent program rewrites the query conditions based on the user's permissions and the de-identification strategy to generate a new SQL query instruction; and the query agent program sends the new SQL query instruction to the database to query and obtain the de-identified data. The correspondence between user permissions and de-identification strategies can be stored using a relational table, and different de-identification strategies corresponding to different user permissions can be obtained by looking up the table.
[0019] Furthermore, in the desensitization unit: if the data usage scenario is a data transmission scenario and the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, when the data type is unstructured data, a trained deep neural network model is used to detect sensitive parts in the unstructured data, the unstructured data is divided into sensitive and non-sensitive parts, the sensitive parts are encrypted using format-preserving encryption technology, and the second data field in the metadata is sensitively detected using the large language model. If the second data field is a sensitive field, the second data field is encrypted using tokenization technology to obtain encrypted metadata. The non-sensitive part, the encrypted sensitive part, and the encrypted metadata are sent together to the user. When the data type is structured data, the structured data is encrypted using a homomorphic encryption algorithm and used as the desensitized data.
[0020] Furthermore, the operation of encrypting the sensitive portion using format-preserving encryption technology involves: obtaining the R, G, and B values of each pixel in the sensitive portion and performing the following operations on them: , where [ ] represents rounding calculation, mod represents modulo calculation, and the calculated f(R), f(G), f(B) are used to replace the original R, G, B values to obtain the decrypted sensitive part.
[0021] The present invention also proposes an apparatus for restoring de-identified data generated using the data de-identification method described above in the payment system, characterized in that the apparatus comprises: The acquisition unit acquires the de-identified data to be restored submitted by the user, which is generated using the data de-identification method in the payment system described above. The detection unit detects the data desensitization and restoration identifier in the desensitized data. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, it sends an unrestoreable prompt message to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, it determines the data type of the desensitized data. The restoration unit, if the data type is structured data, uses the decryption algorithm corresponding to the homomorphic encryption algorithm to decrypt the anonymized data to obtain restored data and sends it to the user. If the data type is unstructured data, it extracts the encrypted sensitive part and encrypted metadata from the anonymized data. For the encrypted sensitive part: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
[0022] The present invention also proposes a computing device, the computing device including a processor and a memory, the processor and the memory communicating via a bus, the memory storing a computer program, which, when executed by the processor, implements the method described in any of the above-mentioned embodiments.
[0023] The present invention also proposes a computer-readable storage medium storing computer program code, which, when executed by a computer, performs any of the methods described above.
[0024] The technical effect of the present invention is as follows: The present invention provides a data desensitization and restoration method, apparatus, and storage medium in a payment system. The method includes: a receiving step S101, for receiving a data desensitization instruction input by a user, the data desensitization instruction including a data desensitization and restoration identifier and a data usage scenario, wherein the desensitization and restoration identifier is used to indicate whether the desensitized data can be restored to the original data; a judging step S102, for obtaining a data object to be desensitized from the database based on the data desensitization instruction, judging the data type of the data object to be desensitized, the data type being structured data or unstructured data, the structured data including order data, transaction data, and payment data, stored using a data table in the database, the data table including at least one first data field, the unstructured data being described in the database using metadata, the metadata including at least one second data field, the unstructured data including images or videos of goods; and a desensitization step S103: for processing the data object to be desensitized based on the data type, data desensitization and restoration identifier, and the data usage scenario, and sending the obtained desensitized data to the user, the desensitized data including the data desensitization and restoration identifier. To address the shortcomings of static data anonymization, this invention proposes a dynamic data anonymization solution based on data type, data anonymization and restoration identifier, and the data usage scenario. This allows for data anonymization based on different application scenarios and whether data restoration is required, improving efficiency while maximizing data confidentiality and security. Furthermore, the use of different anonymization algorithms in different application scenarios ensures the anonymization effect better meets the needs of each scenario. The addition of the data anonymization and restoration identifier to the anonymized data ensures that data restoration is performed by first checking if it is reproducible and then restoring it based on its data type, thus improving restoration efficiency. Attached Figure Description
[0025] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.
[0026] Figure 1 This is a structural diagram of the payment system.
[0027] Figure 2 This is a flowchart of a data anonymization method in a payment system according to an embodiment of the present invention.
[0028] Figure 3 This is a flowchart of a data restoration method in a payment system according to an embodiment of the present invention.
[0029] Figure 4 This is a structural diagram of a data desensitization device in a payment system according to an embodiment of the present invention.
[0030] Figure 5 This is a structural diagram of a data restoration device in a payment system according to an embodiment of the present invention. Detailed Implementation
[0031] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.
[0032] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.
[0033] Figure 1 The diagram illustrates a payment system that includes one or more user terminals, one or more product servers, one or more payment servers, and one or more merchant terminals. The product servers store order data, transaction data, product photos, videos, etc., while the payment servers store payment data, etc.
[0034] Figure 2 This invention illustrates a data anonymization method in a payment system, the method comprising: The receiving step S101 is used to receive a data desensitization instruction input by the user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. In step S102, based on the data desensitization instruction, the data object to be desensitized is obtained from the database, and the data type of the data object to be desensitized is determined. The data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata. The metadata includes at least one second data field. The unstructured data includes images or videos of products. De-identification step S103: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified, and the data usage scenario, the data object to be de-identified is processed, and the de-identified data is sent to the user. The de-identified data includes the data de-identification and restoration identifier.
[0035] To address the shortcomings of static data anonymization, this invention proposes a dynamic data anonymization solution based on data type, data anonymization restoration identifier, and data usage scenario. The data anonymization instruction includes a data anonymization restoration identifier and a data usage scenario. Based on this instruction, the data object to be anonymized is retrieved from the database. The data type of the data object is determined; it can be structured or unstructured. The structured data includes order data, transaction data, and payment data, stored in a database table. Each data table includes at least one first data field. The unstructured data is described in the database using metadata, which includes at least one second data field. The unstructured data includes images or videos of products. The anonymization restoration identifier indicates the anonymized data. Whether the data can be restored to the original data is determined. Finally, based on the data type of the data object to be de-identified, the data de-identification and restoration identifier, and the data usage scenario, the data object to be de-identified is included in the de-identified data. In this way, data de-identification can be performed according to different application scenarios and whether data restoration is required, which improves the efficiency of data de-identification and maximizes data confidentiality, thereby improving data security. Furthermore, since different de-identification algorithms are used in different application scenarios, the de-identification effect is more in line with the needs of the application scenario. In addition, the data de-identification and restoration identifier is added to the de-identified data. During data restoration, the system first checks whether the data is reproducible and then restores it according to the data type, which improves the efficiency of data restoration. This is an important inventive concept of the present invention.
[0036] In one embodiment, in the desensitization step S103: if the data usage scenario is a neural network training sample generation scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, when the data type is unstructured data, the data object to be desensitized is input into the trained generative adversarial neural network model to generate desensitized data, and a large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated desensitized data and the desensitized metadata are sent to the user together. When the data type is structured data, the large language model is used to perform sensitivity detection on the first data field in the data table to obtain the sensitive field, and the content in the data table corresponding to the sensitive field is subjected to the first desensitization processing to obtain desensitized data, which is then sent to the user.
[0037] In this invention, if the application scenario is determined to be a training sample generation scenario and the data cannot be restored, a Generative Adversarial Network (GAN) is used to create highly realistic synthetic data. In scenarios such as medical research and financial risk control, this approach protects privacy while preserving the statistical characteristics of the data. Different desensitization strategies are adopted for different data types. For image and video data, a GAN network is used to generate the data, and a large model is used to identify and mask sensitive fields in the metadata. For structured data, such as data tables, the content in the data table corresponding to the sensitive fields is subjected to a first desensitization process. By adopting different desensitization strategies for different types of data, the adaptability of desensitization is improved, providing a guarantee for the secure sharing and innovative use of data. This is another important inventive concept of this invention.
[0038] In one embodiment, the first desensitization process involves: analyzing and processing the content of the data table corresponding to the sensitive field using the large language model to obtain the grammatical format of the content in the data table corresponding to each sensitive field; generating virtual content corresponding to each sensitive field using the large language model based on the grammatical format; and replacing the content in the data table corresponding to the sensitive field with the virtual content to obtain the desensitized data. That is, for structured data, this invention uses the large language model to analyze and process the content of the data table corresponding to the sensitive field to obtain the grammatical format of the content in the data table corresponding to each sensitive field; and generates virtual content corresponding to each sensitive field based on the grammatical format. In practical applications, the grammatical format output by the large language model can be modified to ensure that the generated content has the same format as the original content, thus improving desensitization efficiency. This is another important inventive concept of this invention.
[0039] In one embodiment, in the de-identification step S103: if the data usage scenario is a user query scenario and the data de-identification and restoration identifier indicates that the de-identified data cannot be restored to the original data, the user's query permission is obtained. When the data type is unstructured data, a data range corresponding to the user's query permission is extracted from the unstructured data. A query image or video is generated based on the data range, and the large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed de-identified metadata. The generated query image or video and the de-identified metadata are sent to the user together. When the data type is structured data, the content of the data table corresponding to the query permission is obtained to generate a user query data table as the de-identified data.
[0040] In one embodiment, the operation of obtaining the content of the data table corresponding to the query permission to generate a user query data table includes: a query agent program deployed between the user and the database obtains the user's SQL query instruction for the data, the SQL query instruction including query conditions; the query agent program rewrites the query conditions based on the user permissions and the de-identification strategy to generate a new SQL query instruction; and the query agent program sends the new SQL query instruction to the database to query and obtain the de-identified data. The correspondence between user permissions and de-identification strategies can be stored using a relational table, and different de-identification strategies corresponding to different user permissions can be obtained by looking up the table.
[0041] The invention employs dynamic data anonymization technology to ensure the security of database queries. Specifically, it achieves fine-grained control over database access through real-time SQL rewriting technology. This technology deploys a proxy gateway between the application and the database, parses user-submitted SQL statements, and rewrites query conditions based on user permissions and anonymization strategies, causing the database to return an anonymized result set. The advantage of this approach is that it eliminates the need to modify application code or database structure, achieving transparent protection of sensitive data—a key inventive feature of this invention.
[0042] In one embodiment, in the de-identification step S103: if the data usage scenario is a data transmission scenario and the data de-identification and restoration identifier indicates that the de-identified data can be restored to the original data, when the data type is unstructured data, a trained deep neural network model is used to detect sensitive parts in the unstructured data, the unstructured data is divided into sensitive and non-sensitive parts, the sensitive parts are encrypted using format-preserving encryption technology, and the second data field in the metadata is sensitively detected using the large language model. If the second data field is a sensitive field, the second data field is encrypted using tokenization technology to obtain encrypted metadata. The non-sensitive part, the encrypted sensitive part, and the encrypted metadata are sent together to the user. When the data type is structured data, the structured data is encrypted using a homomorphic encryption algorithm and used as the de-identified data.
[0043] In this invention, in order to improve the desensitization efficiency, different encryption methods are used for different data types when the desensitized data needs to be reproducible. Furthermore, non-sensitive parts are not desensitized, which greatly reduces the consumption of system resources and improves system performance. This is another important inventive point of this invention.
[0044] In one embodiment, the operation of encrypting the sensitive portion using format-preserving encryption technology involves: obtaining the R, G, and B values of each pixel in the sensitive portion and performing the following operations on them: Where [ ] represents rounding calculation, and mod represents modulo calculation, the calculated f(R), f(G), and f(B) are used to replace the original R, G, and B values to obtain the decrypted sensitive parts. In this invention, in order to quickly desensitize the sensitive parts in images and videos, a pixel-value-based desensitization method is proposed based on the degree of sensory stimulation of R, G, and B to the human eye in the display. This desensitization method has low computational resource consumption and improves desensitization efficiency, which is another important inventive point of this invention.
[0045] Figure 3 A data restoration method based on dynamic permission mapping is shown, which includes: Step S201: Obtain the de-identified data submitted by the user to be restored. The de-identified data to be restored uses the above-mentioned... Figure 1 The data anonymization method at the field level in the payment system shown is used for generation. In detection step S202, the data desensitization and restoration identifier in the desensitized data is detected. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, a prompt message indicating that it cannot be restored is sent to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, the data type of the desensitized data is determined. In restoration step S203, if the data type is structured data, the desensitized data is decrypted using the decryption algorithm corresponding to the homomorphic encryption algorithm to obtain restored data, which is then sent to the user. If the data type is unstructured data, the encrypted sensitive part and the encrypted metadata are extracted from the desensitized data. For the encrypted sensitive part: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
[0046] This invention proposes a dynamic reversible data anonymization method. During user data anonymization, the data to be restored is anonymized using the corresponding method based on its data type. Furthermore, a data anonymization restoration identifier is added to the anonymized data, thereby improving the efficiency of subsequent anonymization. This method is applicable to image and video data. The inverse operation, f(R), yields only one value, which is the same as the original value. This is because the human eye is more sensitive to red, so the R value is desensitized and restored using a linear reversible formula. Green is less sensitive to human vision than red, so the inverse value obtained is an approximation. For blue (B), there may be multiple values, such as f(B) = 0. Yes, the B value can be any value from 0 to 16. Since blue light has a weaker effect on the human eye, one of these values can be randomly selected. As the B value increases, the range of selectable values decreases. In this way, the restored image and video data cannot be distinguished from the original data by the human eye. This is another important inventive point of this invention.
[0047] Figure 4 This invention discloses a data anonymization device in a payment system, the device comprising: The receiving unit 301 is used to receive a data desensitization instruction input by a user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The data desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. The judgment unit 302 retrieves the data object to be desensitized from the database based on the data desensitization instruction, and determines the data type of the data object to be desensitized. The data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata. The metadata includes at least one second data field. The unstructured data includes images or videos of products. De-identification unit 303: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified and the data usage scenario, the data object to be de-identified is processed, and the de-identified data is sent to the user. The de-identified data includes the data de-identification and restoration identifier.
[0048] To address the shortcomings of static data anonymization, this invention proposes a dynamic data anonymization solution based on data type, data anonymization restoration identifier, and data usage scenario. The data anonymization instruction includes a data anonymization restoration identifier and a data usage scenario. Based on this instruction, the data object to be anonymized is retrieved from the database. The data type of the data object is determined; it can be structured or unstructured. The structured data includes order data, transaction data, and payment data, stored in a database table. Each data table includes at least one first data field. The unstructured data is described in the database using metadata, which includes at least one second data field. The unstructured data includes images or videos of products. The anonymization restoration identifier indicates the anonymized data. Whether the data can be restored to the original data is determined. Finally, based on the data type of the data object to be de-identified, the data de-identification and restoration identifier, and the data usage scenario, the data object to be de-identified is included in the de-identified data. In this way, data de-identification can be performed according to different application scenarios and whether data restoration is required, which improves the efficiency of data de-identification and maximizes data confidentiality, thereby improving data security. Furthermore, since different de-identification algorithms are used in different application scenarios, the de-identification effect is more in line with the needs of the application scenario. In addition, the data de-identification and restoration identifier is added to the de-identified data. During data restoration, the system first checks whether the data is reproducible and then restores it according to the data type, which improves the efficiency of data restoration. This is an important inventive concept of the present invention.
[0049] In one embodiment, in the desensitization unit 303: if the data usage scenario is a neural network training sample generation scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, when the data type is unstructured data, the data object to be desensitized is input into the trained generative adversarial neural network model to generate desensitized data, and a large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated desensitized data and the desensitized metadata are sent to the user together. When the data type is structured data, the large language model is used to perform sensitivity detection on the first data field in the data table to obtain the sensitive field, and the content in the data table corresponding to the sensitive field is subjected to the first desensitization processing to obtain desensitized data, which is then sent to the user.
[0050] In this invention, if the application scenario is determined to be a training sample generation scenario and the data cannot be restored, a Generative Adversarial Network (GAN) is used to create highly realistic synthetic data. In scenarios such as medical research and financial risk control, this approach protects privacy while preserving the statistical characteristics of the data. Different desensitization strategies are adopted for different data types. For image and video data, a GAN network is used to generate the data, and a large model is used to identify and mask sensitive fields in the metadata. For structured data, such as data tables, the content in the data table corresponding to the sensitive fields is subjected to a first desensitization process. By adopting different desensitization strategies for different types of data, the adaptability of desensitization is improved, providing a guarantee for the secure sharing and innovative use of data. This is another important inventive concept of this invention.
[0051] In one embodiment, the first desensitization process involves: analyzing and processing the content of the data table corresponding to the sensitive field using the large language model to obtain the grammatical format of the content in the data table corresponding to each sensitive field; generating virtual content corresponding to each sensitive field using the large language model based on the grammatical format; and replacing the content in the data table corresponding to the sensitive field with the virtual content to obtain the desensitized data. That is, for structured data, this invention uses the large language model to analyze and process the content of the data table corresponding to the sensitive field to obtain the grammatical format of the content in the data table corresponding to each sensitive field; and generates virtual content corresponding to each sensitive field based on the grammatical format. In practical applications, the grammatical format output by the large language model can be modified to ensure that the generated content has the same format as the original content, thus improving desensitization efficiency. This is another important inventive concept of this invention.
[0052] In one embodiment, in the desensitization unit 303: if the data usage scenario is a user query scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, the user's query permission is obtained. When the data type is unstructured data, a data range corresponding to the user's query permission is extracted from the unstructured data. A query image or video is generated based on the data range, and the large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated query image or video and the desensitized metadata are sent to the user together. When the data type is structured data, the content of the data table corresponding to the query permission is obtained to generate a user query data table as the desensitized data.
[0053] In one embodiment, the operation of obtaining the content of the data table corresponding to the query permission to generate a user query data table includes: a query agent program deployed between the user and the database obtains the user's SQL query instruction for the data, the SQL query instruction including query conditions; the query agent program rewrites the query conditions based on the user permissions and the de-identification strategy to generate a new SQL query instruction; and the query agent program sends the new SQL query instruction to the database to query and obtain the de-identified data. The correspondence between user permissions and de-identification strategies can be stored using a relational table, and different de-identification strategies corresponding to different user permissions can be obtained by looking up the table.
[0054] The invention employs dynamic data anonymization technology to ensure the security of database queries. Specifically, it achieves fine-grained control over database access through real-time SQL rewriting technology. This technology deploys a proxy gateway between the application and the database, parses user-submitted SQL statements, and rewrites query conditions based on user permissions and anonymization strategies, causing the database to return an anonymized result set. The advantage of this approach is that it eliminates the need to modify application code or database structure, achieving transparent protection of sensitive data—a key inventive feature of this invention.
[0055] In one embodiment, in the desensitization unit 303: if the data usage scenario is a data transmission scenario and the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, when the data type is unstructured data, a trained deep neural network model is used to detect sensitive parts in the unstructured data, the unstructured data is divided into sensitive and non-sensitive parts, the sensitive parts are encrypted using format-preserving encryption technology, and the second data field in the metadata is sensitively detected using the large language model. If the second data field is a sensitive field, the second data field is encrypted using tokenization technology to obtain encrypted metadata. The non-sensitive part, the encrypted sensitive part, and the encrypted metadata are sent together to the user. When the data type is structured data, the structured data is encrypted using a homomorphic encryption algorithm and used as the desensitized data.
[0056] In this invention, in order to improve the desensitization efficiency, different encryption methods are used for different data types when the desensitized data needs to be reproducible. Furthermore, non-sensitive parts are not desensitized, which greatly reduces the consumption of system resources and improves system performance. This is another important inventive point of this invention.
[0057] In one embodiment, the operation of encrypting the sensitive portion using format-preserving encryption technology involves: obtaining the R, G, and B values of each pixel in the sensitive portion and performing the following operations on them: Where [ ] represents rounding calculation, and mod represents modulo calculation, the calculated f(R), f(G), and f(B) are used to replace the original R, G, and B values to obtain the decrypted sensitive parts. In this invention, in order to quickly desensitize the sensitive parts in images and videos, a pixel-value-based desensitization method is proposed based on the degree of sensory stimulation of R, G, and B to the human eye in the display. This desensitization method has low computational resource consumption and improves desensitization efficiency, which is another important inventive point of this invention.
[0058] Figure 5 A data restoration device based on permission dynamic mapping is shown, the device comprising: Acquisition unit 401 acquires the de-identified data to be restored submitted by the user, wherein the de-identified data to be restored uses the above-mentioned... Figure 1 The data anonymization method at the field level in the payment system shown is used for generation. The detection unit 402 detects the data desensitization and restoration identifier in the desensitized data. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, a prompt message indicating that it cannot be restored is sent to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, the data type of the desensitized data is determined. The restoration unit 403, if the data type is structured data, uses the decryption algorithm corresponding to the homomorphic encryption algorithm to decrypt the anonymized data to obtain restored data and sends it to the user. If the data type is unstructured data, it extracts the encrypted sensitive part and the encrypted metadata from the anonymized data. For the encrypted sensitive part: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
[0059] This invention proposes a dynamic reversible data anonymization method. During user data anonymization, the data to be restored is anonymized using the corresponding method based on its data type. Furthermore, a data anonymization restoration identifier is added to the anonymized data, thereby improving the efficiency of subsequent anonymization. This method is applicable to image and video data. The inverse operation, f(R), yields only one value, which is the same as the original value. This is because the human eye is more sensitive to red, so the R value is desensitized and restored using a linear reversible formula. Green is less sensitive to human vision than red, so the inverse value obtained is an approximation. For blue (B), there may be multiple values, such as f(B) = 0. Yes, the B value can be any value from 0 to 16. Since blue light has a weaker effect on the human eye, one of these values can be randomly selected. As the B value increases, the range of selectable values decreases. In this way, the restored image and video data cannot be distinguished from the original data by the human eye. This is another important inventive point of this invention.
[0060] One embodiment of the present invention provides a computing device including a processor and a memory, the processor and the memory communicating via a bus, the memory storing a computer program that, when executed by the processor, implements any of the methods described above.
[0061] One embodiment of the present invention provides a computer storage medium storing a computer program. When the computer program on the computer storage medium is executed by a processor, the above-described method is implemented. The computer storage medium may be a hard disk, DVD, CD, flash memory, or other storage device.
[0062] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.
[0063] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the apparatus described in various embodiments or some parts of the embodiments of this application.
[0064] Finally, it should be noted that the above embodiments are for illustration only and not for limiting the technical solutions of the present invention. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention without departing from the spirit and scope of the present invention. Any modifications or partial substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A data anonymization method in a payment system, characterized in that, The method includes: The receiving step is used to receive a data desensitization instruction input by a user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The data desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. The judgment step involves retrieving the data object to be desensitized from the database based on the data desensitization instruction, determining the data type of the data object to be desensitized, and identifying whether the data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata, which includes at least one second data field. The unstructured data includes images or videos of products. De-identification steps: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified, and the data usage scenario, the data object to be de-identified is processed, and the resulting de-identified data is sent to the user. The de-identified data includes the data de-identification and restoration identifier.
2. The method according to claim 1, characterized in that, In the desensitization step: if the data usage scenario is a neural network training sample generation scenario and the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, when the data type is unstructured data, the data object to be desensitized is input into the trained generative adversarial neural network model to generate desensitized data, and a large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed desensitized metadata. The generated desensitized data and the desensitized metadata are sent to the user together. When the data type is structured data, the large language model is used to perform sensitivity detection on the first data field in the data table to obtain the sensitive field, and the content in the data table corresponding to the sensitive field is subjected to the first desensitization process to obtain desensitized data, which is then sent to the user.
3. The method according to claim 2, characterized in that, The first desensitization process is as follows: using the large language model to analyze and process the content of the data table corresponding to the sensitive field, obtaining the syntax format of the content of the data table corresponding to each sensitive field, using the large language model to generate virtual content corresponding to each sensitive field based on the syntax format, and using the virtual content to replace the content of the data table corresponding to the sensitive field to obtain the desensitized data.
4. The method according to claim 3, characterized in that, In the data anonymization step: if the data usage scenario is a user query scenario and the data anonymization and restoration identifier indicates that the anonymized data cannot be restored to the original data, the user's query permission is obtained. When the data type is unstructured data, a data range corresponding to the user's query permission is extracted from the unstructured data. A query image or video is generated based on the data range, and the large language model is used to perform sensitivity detection on the second data field in the metadata. If the second data field is a sensitive field, the second data field is masked to obtain the processed anonymized metadata. The generated query image or video and the anonymized metadata are sent to the user together. When the data type is structured data, the content of the data table corresponding to the query permission is obtained to generate a user query data table as the anonymized data.
5. The method according to claim 4, characterized in that, In the de-identification step: if the data usage scenario is a data transmission scenario and the data de-identification and restoration identifier indicates that the de-identified data can be restored to the original data, when the data type is unstructured data, a trained deep neural network model is used to detect sensitive parts in the unstructured data, the unstructured data is divided into sensitive and non-sensitive parts, the sensitive parts are encrypted using format-preserving encryption technology, and the second data field in the metadata is sensitively detected using the large language model. If the second data field is a sensitive field, the second data field is encrypted using tokenization technology to obtain encrypted metadata. The non-sensitive part, the encrypted sensitive part, and the encrypted metadata are sent together to the user. When the data type is structured data, the structured data is encrypted using a homomorphic encryption algorithm and used as the de-identified data.
6. A method for restoring de-identified data generated using the data de-identification method in the payment system according to claim 5, characterized in that, The method includes: The acquisition step involves acquiring the de-identified data to be restored submitted by the user, wherein the de-identified data to be restored is generated using the data de-identification method in the payment system described in claim 5; The detection step involves detecting the data desensitization and restoration identifier in the desensitized data. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, a prompt message indicating that it cannot be restored is sent to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, the data type of the desensitized data is determined. The restoration step involves, if the data type is structured data, using the decryption algorithm corresponding to the homomorphic encryption algorithm to decrypt the anonymized data to obtain restored data, which is then sent to the user. If the data type is unstructured data, the encrypted sensitive portion and encrypted metadata are extracted from the anonymized data. For the encrypted sensitive portion: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
7. A data anonymization device for a payment system, characterized in that, The device includes: The receiving unit is used to receive a data desensitization instruction input by the user. The data desensitization instruction includes a data desensitization restoration identifier and a data usage scenario. The data desensitization restoration identifier is used to indicate whether the desensitized data can be restored to the original data. The judgment unit retrieves the data object to be desensitized from the database based on the data desensitization instruction, and determines the data type of the data object to be desensitized. The data type is structured data or unstructured data. The structured data includes order data, transaction data, and payment data, which are stored using a data table in the database. The data table includes at least one first data field. The unstructured data is described in the database using metadata. The metadata includes at least one second data field. The unstructured data includes images or videos of products. De-identification unit: Based on the data type, data de-identification and restoration identifier of the data object to be de-identified, and the data usage scenario, the de-identified data is processed and sent to the user. The de-identified data includes the data de-identification and restoration identifier.
8. An apparatus for restoring de-identified data generated using the data de-identification method in the payment system according to claim 5, characterized in that, The device includes: The acquisition unit acquires the de-identified data to be restored submitted by the user, wherein the de-identified data to be restored is generated using the data de-identification method in the payment system as described in claim 5; The detection unit detects the data desensitization and restoration identifier in the desensitized data. If the data desensitization and restoration identifier indicates that the desensitized data cannot be restored to the original data, it sends an unrestoreable prompt message to the user. If the data desensitization and restoration identifier indicates that the desensitized data can be restored to the original data, it determines the data type of the desensitized data. The restoration unit, if the data type is structured data, uses the decryption algorithm corresponding to the homomorphic encryption algorithm to decrypt the anonymized data to obtain restored data and sends it to the user. If the data type is unstructured data, it extracts the encrypted sensitive part and encrypted metadata from the anonymized data. For the encrypted sensitive part: based on... Perform the inverse operation to obtain the values of R', G', and B', where R' = R, and the values of G' and B' are approximate values of G and B. Use the values of R', G', and B' to replace the values of f(R), f(G), and f(B) in the encrypted sensitive part to obtain the decrypted sensitive part. Then, use tokenization technology to decrypt the encrypted metadata to obtain the decrypted metadata. Finally, send the decrypted sensitive part and the decrypted metadata to the user.
9. A computing device, characterized in that: The computing device includes a processor and memory, which communicate via a bus. The memory stores a computer program that, when executed by the processor, implements the method described in any one of claims 1-6.
10. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.