Big data-based e-commerce platform data privacy protection method and system

Abstract

The application discloses an e-commerce platform data privacy protection method and system based on big data, which comprises the following steps: collecting multi-source heterogeneous data of an e-commerce platform, performing preprocessing, and constructing a privacy correlation graph; generating a task completion condition set according to task dependency description; searching for data supply candidate subgraphs in the privacy correlation graph, extracting privacy data units, and performing substitution processing; constructing a historical exposure subgraph, superimposing and mapping a candidate task feature subgraph and the historical exposure subgraph into the privacy correlation graph; determining a key correlation edge set based on a recovery link identification result, generating a plurality of link cutting schemes, and performing link reconstruction processing; remapping the reconstructed task feature subgraph into the privacy correlation graph; opening a limited calling interface corresponding to a temporary limited execution domain to form a calling disposal record result. The application adopts a privacy correlation graph to realize task-level data privacy protection.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy protection technology, and in particular to a method and system for protecting data privacy on e-commerce platforms based on big data. Background Technology

[0002] As e-commerce platforms expand their business scale, they continuously generate multi-source heterogeneous data during registration, login, browsing, searching, transactions, payments, logistics, after-sales service, customer service interactions, terminal usage, and tagging and profiling. Existing e-commerce data privacy protection methods typically restrict the scope of user data access and output content through access control, field anonymization, data encryption, access auditing, and result export control to reduce the risk of data leakage.

[0003] However, existing methods mostly protect against single access requests or single data tables, typically focusing on determining whether the requesting entity has access rights or performing static anonymization of sensitive fields. They struggle to integrate the overall analysis of relationships between user objects, device objects, order objects, address objects, payment objects, logistics objects, behavioral objects, and time objects within an e-commerce platform. Furthermore, existing methods do not adequately consider the requesting entity's historically acquired data content, historical call results, and historical export results. This makes it difficult to identify the risks of identity recovery, behavioral trajectory recovery, transaction relationship recovery, or profile deduction formed by the combination of currently provided data and historically exposed data. Consequently, even when fulfilling current business tasks, data splicing privacy risks across business processes and time series may still arise.

[0004] Therefore, how to provide data privacy protection methods and systems for e-commerce platforms based on big data is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a data privacy protection method and system for e-commerce platforms based on big data. This invention fully utilizes multi-source heterogeneous data aggregation, privacy association graphs, historical exposure subgraphs, closed privacy recovery link identification, and task-controlled data space technology. It describes in detail the method of identifying privacy recovery risks formed by historical exposure data and current data supply during e-commerce platform business access, and achieves task-level controlled data supply through link reconstruction and temporary restricted execution domains. It has the advantages of accurate privacy recovery risk identification, clear data supply boundaries, strong ability to maintain task completion, and good privacy protection effect across business links.

[0006] The data privacy protection method for e-commerce platforms based on big data according to embodiments of the present invention includes the following steps:

[0007] Collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing on the multi-source heterogeneous data, generate a set of data objects, and construct a privacy association graph based on the set of data objects;

[0008] Receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions based on the task dependency descriptions;

[0009] In the privacy association graph, search data is fed into candidate subgraphs, privacy data units are extracted, and substitution processing is performed to generate candidate task feature subgraphs;

[0010] Construct a historical exposure subgraph, overlay the candidate task feature subgraph with the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results;

[0011] Based on the results of link recovery identification, the key associated edge set is determined, multiple link disconnection schemes are generated, link reconstruction processing is performed, and the feature subgraph of the reconstruction task is obtained.

[0012] The reconstructed task feature subgraph is remapped into the privacy association graph, the closed privacy recovery link is re-identified, and a temporary restricted execution domain is generated to obtain the temporary restricted execution domain configuration result.

[0013] Open the restricted call interface corresponding to the temporary restricted execution domain, identify out-of-bounds call behavior, terminate the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, and form a call handling record result.

[0014] Optionally, the preprocessing includes field unification, time alignment, association identifier normalization, and business process aggregation.

[0015] Optionally, the task completion condition set includes data object category, inter-object relationship, result accuracy range, time span, and result flow boundary.

[0016] Optionally, the step of searching data for candidate subgraphs in the privacy association graph, extracting privacy data units, and performing substitution processing to generate candidate task feature subgraphs specifically includes:

[0017] A candidate search range is formed based on the task completion condition set, and the starting object node and target object node of the current business task are determined within the candidate search range.

[0018] Using the starting object node and the target object node as search endpoints, a path search is performed in the privacy association graph to obtain multiple data supply candidate subgraphs;

[0019] For each data supply candidate subgraph, perform task condition matching processing to form a set of candidate data supply subgraphs;

[0020] For each candidate data supply subgraph in the candidate data supply subgraph set, extract privacy data units;

[0021] The directly related privacy data units are sorted out and stratified by sensitivity to obtain high-sensitivity privacy data units, related-sensitivity privacy data units, and low-sensitivity privacy data units.

[0022] For highly sensitive privacy data units, substitutability judgment, low-sensitivity substitution processing, and task availability organization are performed to form a candidate task feature subgraph.

[0023] Optionally, the construction of the historical exposure subgraph, which overlays the candidate task feature subgraph and the historical exposure subgraph onto the privacy association graph to identify closed privacy recovery links and obtain the recovery link identification results, specifically includes:

[0024] Read the data content already obtained by the requesting subject, historical call results, historical export results and corresponding exposure granularity information, and collect them according to the requesting subject identifier to form a historical exposure basic data set;

[0025] The historical exposure baseline data set is sorted out and its contents are extracted to form a historical exposure mapping data set;

[0026] Based on the exposure granularity information in the historical exposure basic dataset, the historical exposure mapping dataset is granularized and labeled to form a granularized exposure dataset.

[0027] A historical exposure subgraph is constructed based on the granularity-labeled exposure dataset, and combined with the candidate task feature subgraph to form a closed-loop data set;

[0028] The data closed-loop set is subjected to target object unique link identification to form a target object unique link set;

[0029] By identifying the behavioral sequence corresponding to the time-series link in the closed-loop data set, a set of behavioral sequences corresponding to the time-series links can be formed.

[0030] The transaction relationship can be closed-looped by identifying closed-loop chains in the data closed-loop set, thus forming a set of transaction relationship closed-loop chains;

[0031] By performing profile tagging on the closed-loop data set, a profile tagging set that can be inferred from the relationship can be formed.

[0032] The unique link set of the target object, the time sequence link set that the behavior sequence can correspond to, the closed chain set of transaction relationship, and the reverse relationship set that the profile tag can infer are organized to form the recovery link identification result.

[0033] Optionally, the construction of a historical exposure subgraph based on the granularity-labeled exposure data set, and the combination of the candidate task feature subgraph to form a data closed-loop set, specifically includes:

[0034] Construct a historical exposure subgraph corresponding to the request subject based on the granularity-labeled exposure data set;

[0035] Read the candidate task feature subgraph and map the retained privacy data units, replaced privacy data units, and replaced low-sensitivity privacy data units in the candidate task feature subgraph to the corresponding object nodes and relation edges in the privacy association graph, respectively, to form the candidate task feature mapping subgraph.

[0036] The candidate task feature mapping subgraph and the historical exposure subgraph are overlaid and mapped onto the privacy association graph to form an overlaid association graph oriented towards the current access request;

[0037] In the overlay association graph, key association edges are identified to form a set of key association edges;

[0038] Link tracing is performed on the overlay association graph along the key association edges in the key association edge set to form a data closed loop set.

[0039] Optionally, the step of determining the key associated edge set based on the recovery link identification result, generating multiple link disconnection schemes, performing link reconstruction processing, and obtaining the reconstruction task feature subgraph specifically includes:

[0040] Based on the recovery link identification results, a set of recovery links to be reconstructed is formed. The link structure of each closed privacy recovery link in the set of recovery links to be reconstructed is organized to form a recovery link structure description result.

[0041] Based on the description of the recovery link structure, determine the set of key associated edges that enable the closed privacy recovery link to be established;

[0042] For each key associated edge in the key associated edge set, perform cut-off method matching to generate cut-off method matching results;

[0043] Multiple link disconnection schemes are generated based on the disconnection method matching results, forming a link disconnection scheme set;

[0044] For each link disconnection scheme in the set of link disconnection schemes, perform task completion condition preservation calculation, closed privacy restoration link release calculation, and modification cost calculation to form task completion condition preservation result, restoration link release result, and modification content description result;

[0045] Based on the results of maintaining the task completion conditions, the results of restoring the link release, and the description of the changes, the set of link disconnection schemes is filtered to form a set of available link disconnection schemes;

[0046] Sort the available link disconnection schemes in the set of available link disconnection schemes to form the target link disconnection scheme;

[0047] Based on the target link disconnection scheme, link reconstruction processing is performed on the candidate task feature subgraph to form an initial reconstruction task feature subgraph.

[0048] The object nodes and relation edges in the initial reconstruction task feature subgraph are consistent and organized to form a consistent reconstructed reconstruction task feature subgraph.

[0049] Based on the task completion condition set, the output content of the consistency sorting and reconstruction task feature subgraph is sorted to form the reconstruction task feature subgraph.

[0050] Optionally, the step of remapping the reconstructed task feature subgraph to the privacy association graph, re-identifying the closed privacy recovery link, and generating a temporary restricted execution domain to obtain the temporary restricted execution domain configuration result specifically includes:

[0051] Based on the feature subgraph of the reconstruction task, a set of reconstructed feature verification data is formed, and the set of reconstructed feature verification data is mapped to the privacy association graph to form a feature mapping subgraph of the reconstruction task.

[0052] The reconstructed task feature mapping subgraph and the historical exposure subgraph are overlaid and mapped onto the privacy association graph to form a reconstructed overlay association graph;

[0053] In the reconstructed overlay association graph, the set of key association edges for reconstruction is determined, and link tracing is performed along the key association edges in the set of key association edges for reconstruction to form a closed loop set of reconstructed data.

[0054] A closed-loop privacy recovery link is verified on the reconstructed data closed-loop set to generate a reconstructed recovery link verification result.

[0055] Based on the reconstructed recovery link re-verification results, an unrecoverable re-verification result is generated. Based on the task completion condition set, the task completion of the reconstructed task feature subgraph is verified to form a task completion verification result.

[0056] Based on the irreversible re-verification results and the task completion verification results, the execution domain generates a judgment result.

[0057] Based on the execution domain, a basic subgraph is generated, forming an execution domain data mount set, and a restricted data view result is generated based on the execution domain data mount set;

[0058] Based on the task completion condition set, determine the processing operator constraint result, the output result template constraint result, and the access and usage boundary constraint result;

[0059] Based on the results of the restricted data view, the results of the processing operator constraints, the results of the output result template constraints, and the results of the access and use boundary constraints, a temporary restricted execution domain is generated, forming the temporary restricted execution domain configuration result.

[0060] Optionally, the restricted call interface corresponding to the open temporary restricted execution domain identifies out-of-bounds call behavior and terminates the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, forming a call handling record result that specifically includes:

[0061] A restricted call configuration set is formed based on the temporary restricted execution domain configuration results. Restricted call interfaces are then opened based on the restricted call configuration set, resulting in restricted call interface results.

[0062] When the result of the restricted call interface is invoked, the interface call detail data set is collected, and the interface call detail data set is compared with the restricted call configuration set to form the call boundary verification result;

[0063] Generate call record results based on the API call details data set and call boundary verification results;

[0064] Based on the call record results, identify the task completion status and call termination conditions of the current business task, and form a task termination judgment result;

[0065] Based on the task termination judgment result, the temporary restricted execution domain is terminated, resulting in a temporary restricted execution domain termination result.

[0066] Extract the actual exposed content from the call log results and the termination results of the temporary restricted execution domain to form an updated data set of exposure results;

[0067] Update the historical exposure submap based on the exposure results update dataset to form the historical exposure submap update result;

[0068] Based on the call record results, exposure results, updated data set, and historical exposure subgraph update results, the data supply boundary for similar access requests is updated to form the data supply boundary update result;

[0069] The data supply boundary update results are associated with the task completion condition set, the reconstructed task feature subgraph, the recovery link identification results, and the historical exposure subgraph update results to form the call handling record results.

[0070] According to an embodiment of the present invention, a data privacy protection system for e-commerce platforms based on big data includes the following modules:

[0071] The graph construction module is used to collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing, generate a set of data objects, and construct a privacy-related graph.

[0072] The task parsing module is used to receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions.

[0073] The candidate data supply module is used to search for data to supply candidate subgraphs in the privacy association graph, extract privacy data units, perform substitution processing, and generate candidate task feature subgraphs.

[0074] The link identification module is used to construct a historical exposure subgraph, overlay the candidate task feature subgraph and the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results.

[0075] The link reconstruction module is used to determine the key associated edge set based on the recovery link identification results, generate multiple link disconnection schemes, perform link reconstruction processing, and obtain the reconstruction task feature subgraph.

[0076] The execution domain generation module is used to remap the feature subgraph of the reconstruction task to the privacy association graph, re-identify the closed privacy recovery link, and generate a temporary restricted execution domain.

[0077] The call handling module is used to open the restricted call interface corresponding to the temporary restricted execution domain. When the current business task is completed, the access period expires, or an out-of-bounds call occurs, the temporary restricted execution domain is terminated, and the call handling record result is generated.

[0078] The beneficial effects of this invention are:

[0079] This invention generates a task completion condition set based on access requests, searches for candidate data supply subgraphs in a privacy association graph, extracts privacy data units necessary to support the completion of the current business task, eliminates data units that do not meet the task completion condition set, and substitutes high-sensitivity privacy data units that can be replaced by low-sensitivity privacy data units. This reduces the exposure of data that is not directly related to the current business task while meeting the processing requirements of the current business task, thereby reducing the privacy risks caused by excessive data supply.

[0080] This invention constructs a historical exposure subgraph corresponding to the requesting subject and overlays the candidate task feature subgraph with the historical exposure subgraph onto a privacy association graph. This identifies closed privacy recovery links corresponding to unique target objects, behavioral sequences that can correspond to time sequences, transaction relationships that can be closed chains, and profile tags that can be used to infer relationships. This enables the discovery of data splicing and recovery risks that are not easily reflected in a single data supply process but are formed by the combination of historically exposed data and current data supply.

[0081] This invention determines the key association edge set based on the recovery link identification result, generates a link cutting scheme, and selects the target link cutting scheme by preserving the task completion conditions, removing the closed privacy recovery link, and calculating the modification cost. The candidate task feature subgraph is processed for link reconstruction, thereby preserving the data object categories, inter-object relationships, result accuracy range, time span, and result flow boundaries required by the current business task while removing the closed privacy recovery link.

[0082] After the reconstructed task feature subgraph passes irreversible verification and task completion verification, this invention generates a temporary restricted execution domain that is only for the current business task. This domain limits the restricted data view, processing operators, output result templates, access subjects, access periods, call content, and storage duration. The temporary restricted execution domain is terminated when the task is completed, the access period expires, or an out-of-bounds call occurs, forming a call handling record result. This enables data call control, actual exposure records, and boundary updates for similar access requests within the scope of the current business task. Attached Figure Description

[0083] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0084] Figure 1 This is a flowchart of the data privacy protection method and system for e-commerce platforms based on big data proposed in this invention;

[0085] Figure 2 This is a schematic diagram of the structure of the closed privacy recovery link identified by superimposing historical exposure subgraphs and candidate task feature subgraphs in this invention;

[0086] Figure 3 This is a schematic diagram of the system structure of the data privacy protection method and system for e-commerce platforms based on big data proposed in this invention. Detailed Implementation

[0087] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0088] refer to Figure 1 and Figure 2 Data privacy protection methods for e-commerce platforms based on big data include the following steps:

[0089] Collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing on the multi-source heterogeneous data, generate a set of data objects, and construct a privacy association graph based on the set of data objects;

[0090] Receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions based on the task dependency descriptions;

[0091] In the privacy association graph, search data is fed into candidate subgraphs, privacy data units are extracted, and substitution processing is performed to generate candidate task feature subgraphs;

[0092] Construct a historical exposure subgraph, overlay the candidate task feature subgraph with the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results;

[0093] Based on the results of link recovery identification, the key associated edge set is determined, multiple link disconnection schemes are generated, link reconstruction processing is performed, and the feature subgraph of the reconstruction task is obtained.

[0094] The reconstructed task feature subgraph is remapped into the privacy association graph, the closed privacy recovery link is re-identified, and a temporary restricted execution domain is generated to obtain the temporary restricted execution domain configuration result.

[0095] Open the restricted call interface corresponding to the temporary restricted execution domain, identify out-of-bounds call behavior, terminate the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, and form a call handling record result.

[0096] In this embodiment, the process of collecting multi-source heterogeneous data from e-commerce platforms, performing preprocessing on the multi-source heterogeneous data to generate a data object set, and constructing a privacy-preserving association graph based on the data object set specifically includes:

[0097] Collect multi-source heterogeneous data generated by e-commerce platforms during the processes of registration, login, browsing, searching, transactions, payment, logistics, after-sales service, customer service interaction, terminal use, and tag profiling;

[0098] Multi-source heterogeneous data includes at least the data generated during the registration process, login process, browsing process, search process, transaction process, payment process, logistics process, after-sales process, customer service interaction process, terminal usage process, and tag profiling process.

[0099] The data generated in the above-mentioned stages are uniformly incorporated into the original multi-source heterogeneous data set, which serves as the input data basis for field unification, time alignment, association identifier normalization, and business process aggregation processing.

[0100] The system performs record parsing and field extraction on various types of data in the original multi-source heterogeneous dataset, and decomposes each original record according to source type, field content, field value, record time information and business process information;

[0101] Extract account identification information, device identification information, order identification information, address information, payment identification information, logistics identification information, behavior identification information, time information, and data content associated with the above identification information from various types of original records to form a set of records to be unified;

[0102] For a unified set of records, fields are processed uniformly, mapping fields from different sources but with the same or similar semantics, or those that can correspond to the same business object, to a consistent field name and a consistent field type.

[0103] While standardizing field names, the expression format of field values, field content types, and methods for filling in missing fields are also standardized to form a record set with unified fields.

[0104] Perform time alignment processing on the record set after field unification to convert time information from different sources of data that use different time formats, different record precisions and different time zone recording methods to the same time base.

[0105] Time alignment processing includes standardizing the time representation format, converting times in different time zones, adjusting time precision, filling in missing time information, and correcting conflicting time sequences.

[0106] After time alignment, each record in the unified record set corresponds to the same time information under the same time system, so that data from different sources and different business processes can be compared, connected and sorted in the same time series;

[0107] Perform association identifier normalization processing on the time-aligned record set to unify and merge multiple identifiers from different sources but pointing to the same actual object into a unified object identifier;

[0108] In the process of unifying the associated identifiers, the temporal adjacency relationship, business process connection relationship and object correspondence relationship in the records are combined to perform unified object mapping on cross-source records, so that object information that was originally scattered in different data sources can be merged into the same object identifier.

[0109] For the set of records that have completed the association and identification unification, perform business process aggregation processing, and categorize each record into the corresponding business process among the registration business process, login business process, browsing business process, search business process, transaction business process, payment business process, logistics business process, after-sales business process, customer service interaction business process, terminal use business process, and tag profiling business process according to its business process;

[0110] After completing the collection of business processes, the relevant records in multiple business processes are linked together according to the unified object identifier, and the data content formed by the same object in different business processes is aggregated to generate a data object set;

[0111] Each data object in the data object collection contains object category, object identifier, business process to which it belongs, corresponding time information, related object information, and object content information;

[0112] The data object set is split into privacy data units. Each data object is further split into multiple privacy data units according to object category, formation process, time attribute, association attribute and identifiability.

[0113] Each privacy data unit corresponds to one or a group of data contents in a data object that can independently represent the object's attributes, object behavior, object relationship, object location, object payment status, object logistics status, or object time location, and at the same time retains the object category, formation process, time attribute, associated object information, identifiability information, and data content to which the privacy data unit belongs;

[0114] The object categories include at least user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects. All privacy data units formed after being split together constitute a privacy data unit set.

[0115] A privacy association graph is constructed based on a set of privacy data units, with at least two types of objects among user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects and time objects as nodes, and the mapping relationship, co-occurrence relationship, continuous temporal relationship and cross-business link transmission relationship between privacy data units as edges;

[0116] Specifically, when the privacy data units corresponding to two objects have the same unified object identifier, a mapping relationship is established between the corresponding nodes;

[0117] When the privacy data units corresponding to two objects appear simultaneously in the same record, a co-occurrence relationship is established between the corresponding nodes;

[0118] When the privacy data units corresponding to two objects have a sequential event order under the same time information, a continuous temporal relationship is established between the corresponding nodes;

[0119] When the privacy data units corresponding to two objects are in different business processes and there is a data flow, state succession or business transmission relationship, a cross-business process transmission relationship is established between the corresponding nodes;

[0120] Through the above node construction and edge connection processing, a privacy-preserving association graph is formed that can reflect the association paths, time connection paths, and business transmission paths between multiple objects.

[0121] In this embodiment, receiving an access request for target data, generating a task dependency description, and generating a task completion condition set based on the task dependency description specifically include:

[0122] Receive access requests for target data. The access request is generated by the requesting subject when the current business task is initiated. The access request carries the requesting subject identifier, business task identifier, target data information, purpose of use, result output requirements, result retention requirements, and result flow requirements.

[0123] The access request is organized to remove additional descriptive content that is irrelevant to the current business task, and retain the request content that can represent the identity of the requesting subject, the scope of the business task, the scope of the target data, the method of using the result, and the method of result flow, forming an access request parsing object;

[0124] Extract the request subject identifier from the access request parsing object, and match the request subject identifier with the unified object identifier formed by the association identifier to determine the user object, device object or business system object that initiated the current access request;

[0125] When the request subject identifier contains account identifier information, device identifier information, organization identifier information, or interface call identifier information, it corresponds to the user object node, device object node, or object node related to business call in the privacy association graph, respectively, so that the current access request can establish an association with the data object set, privacy data unit set, and privacy association graph.

[0126] Extract the business task identifier and purpose of use from the access request parsing object, and determine the business link, task type and task processing object to which the current business task belongs based on the business task identifier;

[0127] Among them, the business process corresponds to at least one of the following business processes: registration, login, browsing, search, transaction, payment, logistics, after-sales, customer service interaction, terminal usage, and tag profiling.

[0128] Task types include at least one of identity verification, order processing, payment verification, logistics tracking, after-sales processing, customer service response, risk identification, user profile update, business statistics, or operational analysis. The task processing object is used to limit the data object category involved in the current business task.

[0129] Extract the target data pointing information from the access request parsing object, and match the target data pointing information with the object category, object identifier, business process, corresponding time information, associated object information and object content information in the data object set to determine the target data range requested by the current business task;

[0130] When the target data points to the data content of multiple business processes, the corresponding data objects are linked together according to the unified object identifier and unified time information, so that the target data range can cover the object range and business process range required by the current business task.

[0131] Extract the output requirements from the access request parsing object, and determine the type, format and precision range of the results that the current business task needs to output.

[0132] Result types include at least one of the following: detailed results, statistical results, verification results, classification results, matching results, sorting results, prompt results, or API return results;

[0133] The result can be presented in at least one of the following formats: field return, range return, aggregation return, status return, tag return, text summary return, or structured interface return.

[0134] The accuracy range of the results is determined based on the actual needs of the current business task for object positioning accuracy, time expression accuracy, amount expression accuracy, address expression accuracy, behavior description accuracy, and profile tag accuracy, and limits the level of data refinement that the current business task can receive;

[0135] Extract the result retention requirements from the access request parsing object, and determine the storage object, storage location, storage format and storage duration of the results generated by the current business task;

[0136] When the result retention requirement involves intermediate results, detailed results, aggregated results, or interface return results, determine whether they are allowed to be saved by the current requesting body, whether they are allowed to be temporarily stored by the business system, whether they are allowed to be called again, and whether they need to be released after the current business task is completed.

[0137] Based on the result retention requirements, result retention boundaries are established to limit the range of data results that can continue to exist after the current business task is completed;

[0138] Extract the result flow requirements from the access request parsing object to determine whether the result generated by the current business task is allowed to flow between the request body, business system, internal interface, external interface, manual processing node, and automatic processing node;

[0139] When the result flow requires cross-business process transfer, the business process to which the result can flow, the processing object that can be called, and the type of task that can be continued to be undertaken are determined by combining the cross-business process transfer relationship.

[0140] Based on the requirements for result flow, result flow boundaries are established to limit the scope of transferability and acceptance of the results generated by the current business task;

[0141] Generate a task dependency description based on the request subject identifier, business task identifier, target data pointing information, purpose of use, result output requirements, result retention requirements, and result flow requirements;

[0142] The task dependency description includes the correspondence of the request subject, the business link to which the current business task belongs, the types of data objects required by the current business task, the relationships between objects involved in the current business task, the time span required by the current business task, the allowable result precision range of the current business task, the result retention boundary corresponding to the current business task, and the result flow boundary corresponding to the current business task.

[0143] The task depends on establishing a correspondence between the user object, device object, order object, address object, payment object, logistics object, behavior object, and time object in the privacy association graph;

[0144] Determine the types of data objects necessary to complete the current business task based on the task dependency description;

[0145] The data object categories are determined from user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects. Necessary object categories are retained according to the processing objectives of the current business task, while data object categories that do not participate in the completion of the current business task are excluded.

[0146] When the current business task only needs to verify the object status, retain the data object categories that can generate verification results;

[0147] When the current business task requires the formation of transaction, payment, logistics, or after-sales processing results, retain the data object categories that can express the business chain connection relationship;

[0148] Determine the relationships between objects necessary to complete the current business task based on the task dependency description;

[0149] Among them, the relationships between objects are determined from the mapping relationships, co-occurrence relationships, continuous temporal relationships and cross-business link transmission relationships in the privacy association graph. According to the needs of the current business task for object correspondence, record co-occurrence, event sequence and business succession, the relationships that can support the completion of the current business task are retained, and the relationships that only increase the object recognition capability but do not participate in the completion of the current business task are excluded.

[0150] Determine the time span necessary to complete the current business task based on the task dependency description;

[0151] The time span is jointly defined by the starting and ending business stages, the sequence of events, and the output requirements of the current business task, and corresponds to unified time information;

[0152] When the current business task involves continuous actions, transaction processing, payment verification, logistics inquiry or after-sales processing, retain the time range that can express the connection between the preceding and following business processes, and exclude historical time content and future extended time content that exceeds the scope of the current business task.

[0153] Determine the range of result precision necessary to complete the current business task based on the task dependency description;

[0154] The result accuracy range includes at least one of the following: object accuracy, time accuracy, address accuracy, amount accuracy, behavior accuracy, and label accuracy;

[0155] When determining the accuracy range of the results, the current business task can be completed as the boundary. The level of detail, aggregation, interval or state that each type of output result can adopt is determined, and the accuracy range of the results can be invoked by candidate supply subgraph search, candidate task feature subgraph generation and link reconstruction processing.

[0156] Determine the result flow boundaries necessary to complete the current business task based on the task dependency description;

[0157] The boundaries of result flow include the subject that can access the result, the business process that can flow the result, the object that can call the result for processing, the types of tasks that the result can undertake, and the scope of the result that can be saved and used.

[0158] When determining the boundaries of result flow, the requirements for result retention and result flow are included together in the constraints, so that the results generated by the current business task can only flow within the scope of the subject, business process, interface, and processing action defined by the task dependency description.

[0159] The data object categories, relationships between objects, result accuracy range, time span, and result flow boundaries are combined to generate a set of task completion conditions;

[0160] The task completion condition set serves as the data supply constraint for the current business task, limiting the search range of the candidate subgraph, the generation range of the candidate task feature subgraph, the identification range of the closed privacy recovery link, the processing range of the link reconstruction, and the callable data content, executable processing operators, and output result templates of the temporary restricted execution domain.

[0161] In this embodiment, in the privacy association graph, searching for data to supply candidate subgraphs, extracting privacy data units, and performing substitution processing to generate candidate task feature subgraphs specifically includes:

[0162] Read the privacy association graph, data object set, privacy data unit set, and task completion condition set, and obtain the data object categories, inter-object relationships, result accuracy range, time span, and result flow boundaries necessary for the current business task from the task completion condition set;

[0163] The data object categories are mapped to user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects in the privacy association graph. The relationships between objects are mapped to the mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business link transmission relationships in the privacy association graph, forming the candidate search range of the current business task in the privacy association graph.

[0164] Within the candidate search range, determine the starting object node and the target object node of the current business task;

[0165] The starting object node is determined by the request subject identifier, the target data pointing information, and the business task identifier, while the target object node is determined by the data object category corresponding to the output result required by the current business task.

[0166] When the current business task involves a single business process, the object node within the business process that corresponds to the target data range is taken as the target object node.

[0167] When the current business task involves multiple business links, the object nodes that are directly related to the current business task in the registration business link, login business link, browsing business link, search business link, transaction business link, payment business link, logistics business link, after-sales business link, customer service interaction business link, terminal use business link and tag profile business link will be used as target object nodes.

[0168] Using the starting object node and the target object node as search endpoints, the association path is searched along the mapping relationship, co-occurrence relationship, continuous temporal relationship and cross-business link transmission relationship in the privacy association graph;

[0169] During the path search process, object nodes that can connect the data object categories required for the current business task are retained, as are relationship edges that can express object correspondence, record co-occurrence, event sequence, and business acceptance. Data object categories that do not belong to the task completion condition set, object nodes that exceed the time span, cross-business link transmission relationships that exceed the result flow boundary, and relationship edges that only increase object recognition capabilities but do not participate in the completion of the current business task are excluded, resulting in multiple data supply candidate subgraphs that can support the completion of the current business task.

[0170] For each data supply candidate subgraph, task condition matching processing is performed. According to the data object category in the task completion condition set, it is checked whether it contains the object nodes necessary to complete the current business task. According to the relationship between objects, it is checked whether it contains the relationship edges necessary to complete the current business task. According to the time span, it is checked whether it contains the time connection range required by the current business task. According to the result accuracy range, it is checked whether the privacy data units contained therein can generate the output results required by the current business task. According to the result flow boundary, it is checked whether the data content contained therein can be used within the limited subject scope, business link scope, interface scope, and processing action scope. The data supply candidate subgraphs that meet the above checks are collected into a candidate data supply subgraph set.

[0171] For each candidate data supply subgraph in the candidate data supply subgraph set, extract privacy data units that are directly related to the completion of the current business task from the candidate data supply subgraph.

[0172] The directly related privacy data units include privacy data units used to generate detailed results, statistical results, verification results, classification results, matching results, sorting results, prompt results, or interface return results, as well as privacy data units used to maintain object correspondence, event sequence, business succession, and result output relationships in the current business task;

[0173] Privacy data units that are only used to supplement object background, expand object profile, extend historical behavior, refine unnecessary addresses, refine unnecessary time, or connect unnecessary business links will not be included in the current candidate data supply content.

[0174] The directly related privacy data units are sorted out as necessary, and the role of each privacy data unit in the current candidate data supply subgraph is determined according to the result type, result expression form and result accuracy range required by the current business task.

[0175] When a privacy data unit is used to generate the results required for the current business task, to maintain the relationships between objects required for the current business task, or to limit the time range required for the current business task, the privacy data unit will be retained.

[0176] When a privacy data unit does not participate in the generation of the current business task results, does not affect the relationship between objects in the current business task, and does not affect the time connection relationship of the current business task, the privacy data unit will be removed from the current candidate data supply subgraph.

[0177] The remaining privacy data units are processed by sensitivity stratification, and privacy data units that can directly identify user objects, device objects, order objects, address objects, payment objects or logistics objects are classified as high-sensitivity privacy data units;

[0178] Privacy data units that can enhance identification capabilities through continuous temporal relationships, cross-business process transmission relationships, or the co-occurrence of multiple objects are classified as association-sensitive privacy data units.

[0179] Privacy data units that participate in the completion of the current business task only in terms of aggregation status, interval status, classification status, verification status, or label summary status are classified as low-sensitivity privacy data units.

[0180] Sensitivity stratification processing corresponds to the object category, formation process, time attribute, association attribute, and identifiability of privacy data units;

[0181] For highly sensitive privacy data units, a substitutability judgment is performed. When the current business task only needs to confirm whether the object exists, whether the status is consistent, whether the result matches, or whether the statistical result is valid, the directly identified privacy data unit is replaced with the status-based privacy data unit.

[0182] When the current business task only needs to determine the chronological order and does not require precise time information, replace the precise time-type privacy data unit with the time interval-type privacy data unit;

[0183] When the current business task only needs to determine the address range and does not require precise address information, replace the precise address type privacy data unit with the region type privacy data unit;

[0184] When the current business task only needs to determine the amount range, transaction size or payment status, the detailed amount privacy data unit is replaced with the amount range privacy data unit or the payment status privacy data unit.

[0185] When the current business task only needs to output user profile categories and not profile formation details, replace the profile detail type privacy data unit with the profile category type privacy data unit;

[0186] For candidate data supply subgraphs that have completed the substitutability judgment, perform low-sensitivity substitution processing, replace high-sensitivity privacy data units that can satisfy the current business tasks with low-sensitivity privacy data units with corresponding low-sensitivity privacy data units, and simultaneously adjust the mapping relationship, co-occurrence relationship, continuous temporal relationship and cross-business link transmission relationship related to the replaced privacy data units;

[0187] During the replacement process, the object categories required by the current business task, the necessary relationships between objects, the necessary time span, and the result output capabilities are retained, while direct identifiers, detailed addresses, detailed times, detailed amounts, profile formation details, and stable mapping relationships across business processes that are no longer needed due to the replacement process are removed.

[0188] The candidate data supply subgraphs after elimination and replacement are organized for task availability, and it is checked whether they still contain the data object categories, inter-object relationships, result accuracy range, time span and result flow boundaries necessary to complete the current business task;

[0189] When the candidate data subgraph after elimination and replacement can generate the result type, result expression form and interface return content required by the current business task, it is confirmed as a candidate task feature subgraph.

[0190] When the candidate data subgraph after elimination and replacement cannot generate the results required for the current business task, the lowest granularity data content required to complete the task is replenished from the eliminated or replaced privacy data units, and a candidate task feature subgraph is formed again.

[0191] All candidate task feature subgraphs are organized according to their corresponding current business task, request subject identifier, target data range, result accuracy range, time span, and result flow boundary. For each candidate task feature subgraph, its source candidate data supply subgraph, retained privacy data units, removed privacy data units, replaced privacy data units, and replaced low-sensitivity privacy data units are retained. This allows the candidate task feature subgraphs to be overlaid and mapped onto the privacy association graph with the historical exposure subgraphs corresponding to the request subject, which is used to identify closed privacy recovery links.

[0192] In this embodiment, a historical exposure subgraph is constructed, and the candidate task feature subgraph is overlaid and mapped onto the privacy association graph to identify closed privacy recovery links. The recovery link identification results specifically include:

[0193] Read the data content, historical call results, historical export results and corresponding exposure granularity information that the requesting subject has obtained before the current access request, and collect the obtained data content, historical call results, historical export results and corresponding exposure granularity information according to the requesting subject identifier to form a historical exposure basic data set;

[0194] The acquired data includes privacy data units that the requesting entity has previously accessed, viewed, received, or saved; historical access results include the results obtained by the requesting entity through API calls, page queries, batch retrieval, or business processing; historical export results include the data formed by the requesting entity through file export, report generation, API return saving, or task result retention; and exposure granularity information includes object granularity, time granularity, address granularity, amount granularity, behavior granularity, tag granularity, and business process granularity.

[0195] The historical exposure basic data set is sorted out and its content is extracted. The account identification information, device identification information, order identification information, address information, payment identification information, logistics identification information, behavior identification information, time information, tag profile information, and the result generation method corresponding to the above information are extracted. The extracted content is then mapped to user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects in the data object set, privacy data unit set, and privacy association graph to form a historical exposure mapping data set.

[0196] The historical exposure mapping dataset includes historical exposure objects, historical exposure privacy data units, and historical exposure relationships that have been mapped to the privacy association graph.

[0197] Based on the exposure granularity information in the historical exposure basic dataset, the historical exposure privacy data units and historical exposure relationships in the historical exposure mapping dataset are granularly labeled to form a granularly labeled exposure dataset.

[0198] When historically exposed content can directly point to a specific user, device, order, address, payment, or logistics object, the corresponding historically exposed privacy data unit will be marked as detailed exposed content.

[0199] When the historical exposure content only expresses the object status, object category, time range, address range, amount range, behavior category or profile category, the corresponding historical exposure privacy data unit will be marked as summary exposure content;

[0200] When historically exposed content indirectly enhances object identification capabilities through mapping relationships, co-occurrence relationships, continuous temporal relationships, or cross-business process transmission relationships among multiple objects, the corresponding historically exposed privacy data units and historically exposed relationships are marked as associated exposed content.

[0201] A historical exposure subgraph is constructed based on the granularity-labeled exposure dataset, and combined with the candidate task feature subgraph to form a closed-loop data set;

[0202] The data closed-loop set is subjected to target object unique link identification to form a target object unique link set;

[0203] When the historical exposure subgraph has exposed some account identification information, device identification information, address information, order identification information, payment identification information, logistics identification information, behavior identification information, or tag profile information of the target object, and the privacy data units supplemented by the candidate task feature mapping subgraph can point some information to the same user object, the same device object, the same order object, or the same address object through mapping relationship, co-occurrence relationship, or cross-business link transmission relationship, the corresponding data loop will be included in the target object unique link set;

[0204] By identifying the behavioral sequence corresponding to the time-series link in the closed-loop data set, a set of behavioral sequences corresponding to the time-series links can be formed.

[0205] When the historical exposure subgraph has exposed some behavioral content from browsing data, search data, add-to-cart data, transaction data, payment data, logistics data, after-sales data, or customer service interaction data, and the time objects, behavioral objects, or order objects supplemented by the candidate task feature mapping subgraph can arrange some behavioral content into a behavioral sequence with a sequential relationship through continuous temporal sequence, the corresponding data loop will be included in the set of temporal links that correspond to the behavioral sequence.

[0206] The transaction relationship can be closed-looped by identifying closed-loop chains in the data closed-loop set, thus forming a set of transaction relationship closed-loop chains;

[0207] When the historical exposure subgraph has exposed part of the transaction-related content in the order object, payment object, logistics object, address object or after-sales processing content, and the privacy data unit supplemented by the candidate task feature mapping subgraph can connect at least two business links in order generation, payment completion, logistics fulfillment, address delivery and after-sales processing into the same transaction process through mapping relationship, co-occurrence relationship, continuous temporal relationship or cross-business link transmission relationship, the corresponding data loop will be included in the set of transaction relationship closable chains;

[0208] By performing profile tagging on the closed-loop data set, a profile tagging set that can be inferred from the relationship can be formed.

[0209] When the historical exposure subgraph has exposed some profile formation information from browsing behavior, search behavior, transaction behavior, payment status, address area, terminal usage characteristics, or customer service interaction content, and the tag profile information, behavior object, time object, or order object supplemented by the candidate task feature mapping subgraph can be reversed to the basis for the formation of profile tags through co-occurrence relationship, continuous temporal relationship, or cross-business link transmission relationship, the corresponding data loop will be included in the profile tag reverse relationship set;

[0210] The unique link set of the target object, the time-series link set that corresponds to the behavior sequence, the closed chain set of transaction relationship, and the reverse relationship set that can be deduced from the profile tag are organized to form the recovery link identification result;

[0211] The recovery link identification results record the historical exposure nodes, historical exposure edges, candidate data supply nodes, candidate data supply edges, key related edges, object categories involved, business links involved, corresponding unified time information, data content involved in recovery, and corresponding exposure granularity information contained in each closed privacy recovery link. The type is marked according to the uniqueness of the target object, the corresponding time sequence formed by the behavior sequence, the closed chain formed by the transaction relationship, and the reverse relationship formed by the profile label.

[0212] Based on the recovery link identification results, the candidate task feature subgraphs are marked with recovery risks.

[0213] When the recovery link identification result does not include a unique link for the target object, a temporal link that corresponds to the behavior sequence, a closed chain of transaction relationship, or a relationship that can be inferred from the profile label, the candidate task feature subgraph is marked as a candidate task feature subgraph that has not formed a closed privacy recovery link.

[0214] When the recovery link identification result contains at least one of the following: a unique link for the target object, a time-series link that corresponds to the behavior sequence, a closed chain of transaction relationship, or a reverse relationship that can be deduced from the profile tag, the candidate task feature subgraph is marked as a candidate task feature subgraph that forms a closed privacy recovery link, and the recovery link identification result is output to the link reconstruction process.

[0215] In this embodiment, the construction of a historical exposure subgraph based on the granularity-labeled exposure data set, and the combination of the candidate task feature subgraph to form a data closed-loop set specifically includes:

[0216] The user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects in the exposed data set are used as historical exposure nodes by granular labeling;

[0217] Using the mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business link transmission relationships that have been exposed or can be determined by historical exposure content in the granularity-labeled exposure data set as historical exposure edges, construct the historical exposure subgraph corresponding to the request subject;

[0218] Each historical exposure node in the historical exposure subgraph retains the corresponding object category, object identifier, business process to which it belongs, unified time information, exposure granularity information, and exposure source information. Each historical exposure edge in the historical exposure subgraph retains the corresponding relationship type, relationship source, formation process, and exposure method.

[0219] Read the candidate task feature subgraph and map the retained privacy data units, replaced privacy data units, and replaced low-sensitivity privacy data units in the candidate task feature subgraph to the corresponding object nodes and relation edges in the privacy association graph, respectively, to form the candidate task feature mapping subgraph.

[0220] In the candidate task feature mapping subgraph, the user object, device object, order object, address object, payment object, logistics object, behavior object and time object in the candidate task feature subgraph are respectively mapped to the same type of object node in the privacy association graph. The mapping relationship, co-occurrence relationship, continuous temporal relationship and cross-business link transmission relationship in the candidate task feature subgraph are respectively mapped to the same type of relationship edge in the privacy association graph.

[0221] The candidate task feature mapping subgraph and the historical exposure subgraph are overlaid and mapped onto the privacy association graph to form an overlaid association graph oriented towards the current access request;

[0222] In the overlay association graph, historical exposure nodes and edges from the historical exposure subgraph are marked as historical exposure nodes, candidate data supply nodes and candidate data supply edges from the candidate task feature mapping subgraph are marked as current data supply nodes, and object nodes and relational edges that exist in both the historical exposure subgraph and the candidate task feature mapping subgraph are marked as repeated exposure nodes. The object category, business process, unified time information, exposure granularity information and result flow boundary corresponding to each mark are retained.

[0223] In the overlay association graph, key association edges are identified to form a set of key association edges;

[0224] The key association edge set includes mapping relationship edges that can connect historical exposed nodes with candidate data supply nodes, co-occurrence relationship edges that can make two or more objects appear together in the same record or the same result, continuous temporal relationship edges that can make behavior objects, order objects, payment objects, logistics objects and time objects form a sequential connection relationship, and cross-business link transmission relationship edges that can form object transmission or state inheritance between registration business links, login business links, browsing business links, search business links, transaction business links, payment business links, logistics business links, after-sales business links, customer service interaction business links, terminal use business links and tag profiling business links;

[0225] Link tracing is performed on the overlay association graph along the key association edges in the key association edge set to identify whether a data loop is formed between historical exposed nodes, historical exposed edges, candidate data supply nodes and candidate data supply edges, which involves at least one historical exposed content and at least one current data supply content, thus forming a data loop set;

[0226] Each data loop in the data loop set contains at least two types of object nodes, selected from user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects. Each data loop also contains at least two types of relationship edges, selected from mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business link transmission relationships.

[0227] In this embodiment, based on the link recovery identification results, a set of key associated edges is determined, multiple link disconnection schemes are generated, and link reconstruction processing is performed to obtain a feature subgraph of the reconstruction task, specifically including:

[0228] Read the recovery link identification results, candidate task feature sub-graph, historical exposure sub-graph, privacy association graph, and task completion condition set;

[0229] Extract the unique link set of the target object, the time sequence link set that the behavior sequence can correspond to, the closed chain set of transaction relationship, and the reverse relationship set that the profile tag can infer from the recovery link identification results. Then, collect the historical exposed nodes, historical exposed edges, candidate data supply nodes, candidate data supply edges, key related edges, object categories, business links, unified time information, data content involved in recovery, and exposure granularity information contained in the above link sets to form the recovery link set to be reconstructed.

[0230] For each closed privacy recovery link in the set of recovery links to be reconstructed, the link structure is organized. According to the connection order between historical exposed content and current data supply content, the starting historical exposed node, intermediate connection node, current data supply node and closed back pointer node in the closed privacy recovery link are determined. The relationship edges in the closed privacy recovery link are classified according to mapping relationship, co-occurrence relationship, continuous temporal relationship and cross-business link transmission relationship to form the recovery link structure description result.

[0231] Based on the description of the recovery link structure, determine the set of key associated edges that enable the closed privacy recovery link to be established;

[0232] The key association edge set includes mapping relationship edges that can directly connect historical exposed nodes and candidate data supply nodes, co-occurrence relationship edges that can enable multiple objects to appear together in the same record or the same result, continuous temporal relationship edges that can enable multiple behavioral objects to form a succession of previous and subsequent relationships according to unified time information, and cross-business link transfer relationship edges that can form object transfer, state succession or result flow between different business links.

[0233] For each key associated edge in the key associated edge set, perform cut-off method matching to generate cut-off method matching results;

[0234] When a key associated edge is a mapping edge and the mapping edge depends on account identifier information, device identifier information, order identifier information, address information, payment identifier information, or logistics identifier information, the bridging identifier will be removed or the direct identifier content will be replaced as the corresponding disconnection method.

[0235] When a key associated edge is a co-occurrence relationship edge and the co-occurrence relationship edge depends on multiple objects in the same record or the same result to appear simultaneously, the corresponding cutting method will be to aggregate detailed numerical content, replace direct identifier content, or split the result expression content.

[0236] When the key associated edge is a continuous temporal relationship edge and the continuous temporal relationship edge depends on precise time information or the sequence of continuous events, the corresponding cutting method will be to break up the continuous temporal sequence or reduce the precision of the time expression.

[0237] When a critical associated edge is a cross-business process transmission relationship edge and the cross-business process transmission relationship edge depends on the establishment of a stable object identifier, stable state acceptance, or stable result flow, the corresponding cutting-off method will be to remove the cross-business process stable mapping relationship, reduce the spatial positioning accuracy, or restrict the result flow boundary.

[0238] Multiple link disconnection schemes are generated based on the disconnection method matching results, forming a link disconnection scheme set;

[0239] Each link disconnection scheme includes the key associated edge to be processed, the corresponding disconnection method, the privacy data unit to be processed, the object node to be adjusted, the relation edge to be adjusted, and the data expression form after processing;

[0240] The processed data representation includes at least one of the following: object content after removing bridging identifiers, time content after breaking up continuous time sequences, address content after reducing spatial positioning accuracy, status content after replacing direct identifier content, interval content after aggregating detailed numerical content, and business link connection content after removing stable mapping relationships across business links.

[0241] For each link disconnection scheme in the set of link disconnection schemes, the task completion condition preservation calculation is performed to form the task completion condition preservation result;

[0242] The task completion conditions maintain the following results: object category maintains value, inter-object relationship maintains value, result accuracy maintains value, time span maintains value, and result flow boundary maintains value.

[0243] When the link disconnection scheme is processed and all data object categories necessary for the current business task are retained, the object category value is kept as one; otherwise, it is kept as zero.

[0244] When the link disconnection scheme retains all the inter-object relationships necessary for the current business task, the inter-object relationship value is recorded as one; otherwise, it is recorded as zero.

[0245] When the result of the link disconnection scheme is still within the result accuracy range defined by the task completion condition set, the result accuracy is recorded as one; otherwise, it is recorded as zero.

[0246] When the unified time information processed by the link disconnection scheme still covers the time span limited by the task completion condition set, the time span value is recorded as one; otherwise, it is recorded as zero.

[0247] When the results of the link disconnection scheme are all within the result flow boundary defined by the task completion condition set, the result flow boundary value is recorded as one; otherwise, it is recorded as zero.

[0248] The task completion condition preservation value is obtained by multiplying the object category preservation value, the inter-object relationship preservation value, the result accuracy preservation value, the time span preservation value, and the result flow boundary preservation value in sequence.

[0249] For each link disconnection scheme in the set of link disconnection schemes, perform closed-loop privacy recovery link release calculation to form a recovery link release result;

[0250] For the unique link of the target object, when the link disconnection scheme can no longer link the historical exposed content and the current data supply content to the same user object, the same device object, the same order object or the same address object through mapping relationship, co-occurrence relationship or cross business link transmission relationship, the release value of the unique link of the target object is recorded as one; otherwise, it is recorded as zero.

[0251] For behavior sequences that correspond to time-series links, when the link disconnection scheme makes it impossible to arrange the historical exposed content and the current data supply content into a behavior sequence with a sequential relationship through continuous time sequence, the release value of the behavior sequence that corresponds to the time-series link is recorded as one; otherwise, it is recorded as zero.

[0252] For a closable chain of transaction relationships, when the link disconnection scheme makes it impossible to connect at least two business links in order generation, payment completion, logistics fulfillment, address delivery and after-sales processing into the same transaction process through mapping relationship, co-occurrence relationship, continuous temporal relationship or cross business link transmission relationship, the release value of the closable chain of transaction relationships is recorded as one; otherwise, it is recorded as zero.

[0253] Regarding the reverse inference relationship of profile tags, when the link disconnection solution makes it impossible to reverse the historical exposed content and the current data supply content to the basis for the formation of profile tags through co-occurrence relationship, continuous temporal relationship or cross-business link transmission relationship, the value of the removal of the reverse inference relationship of profile tags is recorded as one; otherwise, it is recorded as zero.

[0254] Add up all the release values ​​corresponding to the link disconnection scheme to get the number of links disconnected; divide the number of links disconnected by the total number of closed privacy recovery links before the link disconnection scheme to get the link disconnection ratio.

[0255] The cost of modifying each link disconnection scheme in the set of link disconnection schemes is calculated, and the modification content description result is generated;

[0256] The changes include the number of bridging identifiers removed, the number of continuous temporal sequence fragments broken, the number of spatial positioning reductions, the number of direct identifier replacements, the number of detailed value aggregations, the number of stable mapping relationships removed across business processes, the number of privacy data units adjusted, the number of relationship edges adjusted, and the cost of the changes.

[0257] Among them, the basic cost value for removing a bridging identifier is six, the basic cost value for breaking up a continuous time-series content is four, the basic cost value for reducing a spatial positioning accuracy content is three, the basic cost value for replacing a direct identifier content is five, the basic cost value for aggregating a detailed numerical content is two, the basic cost value for removing a cross-business stable mapping relationship is four, the basic cost value for adjusting a privacy data unit is one, and the basic cost value for adjusting a relationship edge is one.

[0258] Multiply the number of each type of processing by its corresponding base cost, and add the products together to obtain the modified cost of the link disconnection scheme.

[0259] Based on the results of maintaining the task completion conditions, the results of restoring the link release, and the description of the changes, the set of link disconnection schemes is filtered to form a set of available link disconnection schemes;

[0260] When the task completion condition of a certain link disconnection scheme remains at one, the link release ratio of the link disconnection scheme is one, and the accuracy range, time span and result flow boundary of the result after the link disconnection scheme are all within the range of the task completion condition set, the link disconnection scheme is included in the set of available link disconnection schemes.

[0261] When the task completion condition of a certain link disconnection scheme remains zero, or the link release ratio of the link disconnection scheme is not one, or any of the following exceeds the limit of the task completion condition set: the accuracy range, time span, and result flow boundary of the result after the link disconnection scheme is processed, the link disconnection scheme will be excluded from the link disconnection scheme set.

[0262] Sort the available link disconnection schemes in the set of available link disconnection schemes to form the target link disconnection scheme;

[0263] The sorting is based on the cost of the changes from low to high, and the link disconnection scheme ranked first is selected as the target link disconnection scheme.

[0264] When at least two link disconnection schemes have the same modification cost, they are sorted in the first order according to the number of direct identifier replacements from low to high, and the link disconnection scheme ranked first is selected after the first sorting is completed.

[0265] If at least two link disconnection schemes still have the same ranking after the first sorting, a second sorting is performed according to the number of bridge identifiers removed from low to high, and the link disconnection scheme ranked first is selected after the second sorting is completed.

[0266] If at least two link disconnection schemes still have the same ranking after the second sorting, a third sorting is performed according to the number of removals in the cross-business stable mapping relationship from low to high, and the link disconnection scheme ranked first is selected after the third sorting is completed.

[0267] If at least two link disconnection schemes still have the same ranking after the third sorting, a fourth sorting is performed according to the number of privacy data units adjusted from low to high, and the link disconnection scheme ranked first is selected after the fourth sorting is completed.

[0268] If at least two link disconnection schemes still have the same ranking after the fourth sorting, the fifth sorting is performed according to the number of relationship edges adjusted from low to high, and the link disconnection scheme ranked first is selected as the target link disconnection scheme after the fifth sorting is completed.

[0269] Based on the target link disconnection scheme, link reconstruction processing is performed on the candidate task feature subgraph to form an initial reconstruction task feature subgraph.

[0270] When performing link reconstruction processing, the following steps are performed: removing the bridging identifier from the privacy data unit pointing to the bridging identifier in the target link disconnection scheme; breaking up the continuous time sequence for the privacy data unit pointing to the continuous time sequence; reducing the spatial positioning accuracy for the privacy data unit pointing to the spatial positioning; replacing the direct identifier content for the privacy data unit pointing to the direct identifier content; aggregating the detailed value content for the privacy data unit pointing to the detailed value content; and removing the cross-business stable mapping relationship for the relationship edge pointing to the cross-business stable mapping relationship.

[0271] The object nodes and relation edges in the initial reconstruction task feature subgraph are consistent and organized to form a consistent reconstructed reconstruction task feature subgraph.

[0272] In the feature subgraph of the consistency reorganization and reconstruction task, retain the user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects and time objects required by the current business task, retain the mapping relationships, co-occurrence relationships, continuous temporal relationships and cross-business link transmission relationships required by the current business task, and delete the object nodes and relationship edges that no longer have a basis for connection due to the removal of bridging identifiers, the breaking up of continuous temporal sequence, the reduction of spatial positioning accuracy, the replacement of direct identifier content, the aggregation of detailed numerical content, or the removal of stable mapping relationships across business links;

[0273] Based on the task completion condition set, the output content of the consistency sorting and reconstruction task feature subgraph is sorted to form the output content sorting and reconstruction task feature subgraph.

[0274] In the output content organization and reconstruction task feature sub-graph, the status content, interval content, aggregated content, classified content, verification content and interface structured return content that can meet the current business task are retained, while the detailed content, direct identification content, precise address content, precise time content and cross-business link stable connection content that exceed the result accuracy range, time span or result flow boundary of the current business task are removed.

[0275] The output content is organized and reconstructed into a feature subgraph of the task, which is then identified as the feature subgraph of the task. The feature subgraph of the task retains the reconstruction source information, the information of the severed key related edges, the information of the processed privacy data units, the information of the adjusted relationship edges, the corresponding target link severing scheme, and the corresponding recovery link identification results.

[0276] In this embodiment, the reconstructed task feature subgraph is remapped onto the privacy association graph, the closed privacy recovery link is re-identified, and a temporary restricted execution domain is generated. The specific results of obtaining the temporary restricted execution domain configuration include:

[0277] The object nodes, relation edges, privacy data units, processed privacy data unit information, adjusted relation edge information, and reconstruction source information in the reconstruction task feature subgraph are collected to form a reconstruction feature verification data set.

[0278] The reconstructed feature verification dataset is mapped onto the privacy association graph to form a reconstructed task feature mapping subgraph. The reconstructed task feature mapping subgraph and the historical exposure subgraph are then overlaid onto the privacy association graph to form a reconstructed overlay association graph.

[0279] In the reconstructed overlay association graph, historical exposure nodes and edges from the historical exposure subgraph are marked as historical exposure nodes, reconstruction data supply nodes and reconstruction data supply edges from the reconstruction task feature mapping subgraph are marked as reconstruction data supply nodes, object nodes and relational edges that exist in both the historical exposure subgraph and the reconstruction task feature mapping subgraph are marked as repeated exposure nodes, and object nodes, privacy data units and relational edges that have been processed by the target link cutting-off scheme are marked as reconstruction processing nodes.

[0280] In the reconstructed overlay association graph, the set of key association edges for reconstruction is determined, and link tracing is performed along the key association edges in the set of key association edges for reconstruction to form a closed loop set of reconstructed data.

[0281] The set of key reconstructed edges includes mapping edges that can still connect historically exposed nodes and reconstructed data supply nodes after link reconstruction; co-occurrence edges that can still allow two or more objects to appear in the same record or the same result; continuous temporal relationship edges that can still allow behavior objects, order objects, payment objects, logistics objects and time objects to form a sequential connection; and cross-business link transfer relationship edges that can still allow different business links to form object transfer, state inheritance or result flow.

[0282] Each data loop in the reconstructed data loop set contains at least two types of object nodes. The object nodes are selected from user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects. Each data loop also contains at least two types of relationship edges. The relationship edges are selected from mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business link transmission relationships.

[0283] A closed-loop privacy recovery link is verified on the reconstructed data closed-loop set to generate a reconstructed recovery link verification result.

[0284] When the historical exposure subgraph has exposed some account identification information, device identification information, address information, order identification information, payment identification information, logistics identification information, behavior identification information, or tag profile information of the target object, and the privacy data units retained by the reconstruction task feature mapping subgraph can still point some information to the same user object, the same device object, the same order object, or the same address object through mapping relationship, co-occurrence relationship, or cross-business link transmission relationship, the unique link of the reconstruction target object is recorded in the reconstruction recovery link verification result;

[0285] When the historical exposure subgraph has exposed some behavioral content from browsing data, search data, add-to-cart data, transaction data, payment data, logistics data, after-sales data, or customer service interaction data, and the time object, behavioral object, or order object retained by the reconstruction task feature mapping subgraph can still arrange some behavioral content into a behavioral sequence with a sequential relationship through continuous temporal sequence, the reconstruction behavioral sequence can be recorded as corresponding to the temporal sequence link in the reconstruction recovery link verification results;

[0286] When the historical exposure subgraph has exposed part of the transaction-related content in the order object, payment object, logistics object, address object or after-sales processing content, and the privacy data unit retained by the reconstruction task feature mapping subgraph can still connect at least two business links in order generation, payment completion, logistics fulfillment, address delivery and after-sales processing into the same transaction process through mapping relationship, co-occurrence relationship, continuous temporal relationship or cross-business link transmission relationship, the reconstructed transaction relationship can be closed chain recorded in the reconstructed recovery link verification result;

[0287] When the historical exposure subgraph has exposed some profile formation information from browsing behavior, search behavior, transaction behavior, payment status, address region, terminal usage characteristics, or customer service interaction content, and the tag profile information, behavior object, time object, or order object retained by the reconstruction task feature mapping subgraph can still be reversed to the basis for the formation of profile tags through co-occurrence relationship, continuous temporal relationship, or cross-business link transmission relationship, the reverse relationship of reconstruction profile tags is recorded in the reconstruction recovery link verification results;

[0288] Generate an unrecoverable verification result based on the reconstructed recovery link verification result;

[0289] When the reconstructed recovery link verification result fails to record the unique link of the reconstructed target object, the time-series link that can be corresponding to the reconstructed behavior sequence, the closed chain of the reconstructed transaction relationship, and the reverse relationship that can be deduced from the reconstructed profile tag, an unrecoverable verification pass result is formed.

[0290] When the reconstructed recovery link verification result record includes at least one of the following: a unique link for the reconstructed target object, a time-series link that corresponds to the reconstructed behavior sequence, a closed chain for the reconstructed transaction relationship, or a reverse relationship that can be deduced from the reconstructed profile tag, an unrecoverable verification failure result is formed.

[0291] Based on the task completion condition set, the task completion of the reconstructed task feature subgraph is verified to generate a task completion verification result.

[0292] When the reconstructed task feature subgraph retains all data object categories necessary for the current business task, all relationships between objects, output content within the result precision range defined by the task completion condition set, unified time information covering the time span defined by the task completion condition set, and the result access subject, result transfer business link, result call processing object, result accept task type, and result save and use scope within the result flow boundary defined by the task completion condition set, a task completion pass result is formed.

[0293] If any of the above conditions are not met by the reconstructed task feature subgraph, a task completion failure result is generated.

[0294] Based on the irreversible re-verification results and the task completion verification results, the execution domain generates a judgment result.

[0295] When both the irreversible re-verification pass result and the task completion pass result are obtained simultaneously, the reconstructed task feature subgraph is determined as the execution domain generation base subgraph, and the execution domain generation pass result is formed.

[0296] When an irreversible re-verification failure result or a task completion failure result is obtained, the reconstructed task feature subgraph is marked as a task feature subgraph to be reconstructed, and an execution domain is generated to produce a failure result.

[0297] When generating the execution domain result, the privacy data units, object nodes, relationship edges, result expression content and processing action information that the current business task is allowed to call are extracted from the execution domain generation basic subgraph to form the execution domain data mounting set, and the restricted data view result is generated based on the execution domain data mounting set;

[0298] The restricted data view results only include privacy data units and data expression content retained by the feature subgraph of the reconstruction task and verified by the task completion. The results are presented as status content, interval content, aggregated content, classified content, verification content or structured return content of the interface according to the result accuracy range limited by the task completion condition set. It does not present bridging identifiers that have been removed, direct identifier content that has been replaced, original spatial positioning content that has been reduced in accuracy, original continuous temporal content that has been broken down, detailed numerical content before aggregation, and stable mapping relationships across business links that have been removed.

[0299] Based on the task completion condition set, determine the processing operator constraint result, the output result template constraint result, and the access and usage boundary constraint result;

[0300] The processing operator limit results include at least one of the following operators that are allowed to be executed in the current business task: query operator, verification operator, aggregation operator, classification operator, matching operator, sorting operator, statistical operator, status return operator, and interface return operator. Processing operators that can restore detailed content, restore direct identification content, restore precise address content, restore precise time content, restore profile forming details, or rebuild stable mapping relationships across business links are excluded.

[0301] The output result template limits the field structure, result type, result expression format, result precision range, result return object, and result flow range that the current business task allows to output.

[0302] The access and usage boundary restriction results include the request subject identifier of the restricted data view results that the current business task is allowed to access, the business links that are allowed to be accessed, the scope of interfaces that are allowed to be called, the scope of processing actions that are allowed to be executed, the content of the results that are allowed to be saved, and the duration of use that are allowed to be saved.

[0303] Based on the results of the restricted data view, the results of the processing operator constraints, the results of the output result template constraints, and the results of the access and use boundary constraints, a temporary restricted execution domain is generated, forming the temporary restricted execution domain configuration result.

[0304] The temporary restricted execution domain configuration result only mounts the restricted data view result, only opens the processing operators contained in the processing operator-limited result, only allows the generation of output results according to the output result template, and limits the accessible subject, accessible time period, callable data content, executable processing operators, output result template and saveable usage duration according to the access and use boundary limit result.

[0305] In this embodiment, the restricted call interface corresponding to the temporary restricted execution domain is opened, out-of-bounds call behavior is identified, and the temporary restricted execution domain is terminated when the current business task is completed, the access period expires, or an out-of-bounds call occurs, forming a call handling record result, specifically including:

[0306] The accessible subjects, accessible time periods, callable data content, executable processing operators, output result templates, and saveable usage durations in the temporary restricted execution domain configuration results are collected to form a restricted call configuration set.

[0307] Based on the restricted call configuration set, open the restricted call interface to form the restricted call interface result;

[0308] The restricted API call results can only be accessed by the request subject identifier specified in the boundary limit results within the accessible time period. Only query operators, verification operators, aggregation operators, classification operators, matching operators, sorting operators, statistical operators, status return operators, or API return operators contained in the processing operator limit results are allowed to be called. And only the output results allowed by the current business task can be generated according to the output result template limit results.

[0309] When the result of the restricted call interface is invoked, the following information is collected for each interface call: request subject identifier, call time, call interface, call action, call parameters, accessed privacy data unit, accessed object node, accessed relationship edge, executed processing operator, generated result content, result output format, result saving action and result flow destination, forming an interface call detailed data set;

[0310] The API call details data set is compared with the restricted call configuration set to form the call boundary verification result;

[0311] When the request subject identifier, call time, call interface, call action, accessed privacy data unit, executed processing operator, generated result content, result output format, result saving action and result flow destination of a certain interface call are all within the scope of the restricted call configuration set, the interface call is marked as a call content within the boundary.

[0312] When any one of the following in a certain interface call exceeds the limit of the restricted call configuration set, the interface call, the call action, the accessed privacy data unit, the executed processing operator, the generated result content, the result output format, the result saving action, or the result flow destination exceeds the limit of the restricted call configuration set, the interface call is marked as out-of-bounds call content.

[0313] Generate call record results based on the API call details data set and call boundary verification results;

[0314] The call record results include the call content within the boundary, the call content outside the boundary, the privacy data unit actually accessed, the object node actually accessed, the relation edge actually accessed, the processing operator actually executed, the result content actually generated, the format of the result actually output, the result content actually saved, and the destination of the result actually transferred.

[0315] Based on the call record results, identify the task completion status and call termination conditions of the current business task, and form a task termination judgment result;

[0316] When the call log result indicates that the current business task has generated an output result consistent with the task completion condition set, a task completion termination result is generated.

[0317] When the call log result indicates that the current access request has reached the accessible time period or the saveable usage duration specified in the access usage boundary limit result, a time limit termination result is generated.

[0318] When the call log result contains out-of-bounds call content, an out-of-bounds call termination result is generated;

[0319] When the temporarily restricted execution domain receives an instruction to end the current business task, a task instruction termination result is generated;

[0320] Based on the task termination judgment result, the temporary restricted execution domain is terminated, resulting in a temporary restricted execution domain termination result.

[0321] When any of the following results are generated: task completion termination, time limit termination, out-of-bounds call termination, or task instruction termination, close the restricted call interface result, stop further access to the restricted data view result, stop further calls to the processing operators in the processing operator-limited result, stop further generation of the result corresponding to the output result template-limited result, and release the intermediate processing content, temporary query content, temporary aggregation content, and result content that is not allowed to be saved in the temporary restricted execution domain.

[0322] Extract the actual exposed content from the call log results and the termination results of the temporary restricted execution domain to form an updated data set of exposure results;

[0323] The actual exposed content includes the privacy data units actually accessed, the actual generated result content, the actual output result format, the actual saved result content, the actual destination of the results, the data content marked as content called within the boundary, and the data content marked as content called beyond the boundary. The request subject identifier, business task identifier, object category, business link, unified time information, exposure granularity information, and exposure source information corresponding to the actual exposed content are retained.

[0324] Update the historical exposure submap based on the exposure results update dataset to form the historical exposure submap update result;

[0325] When generating the historical exposure subgraph update results, the user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects in the exposure result update data set are supplemented as historical exposure nodes. The mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business link transmission relationships that can be determined in the exposure result update data set are supplemented as historical exposure edges. The exposure granularity information, exposure source information, call time, result output format, and result flow destination in the exposure result update data set are written into the corresponding historical exposure nodes and corresponding historical exposure edges.

[0326] Based on the call record results, exposure results, updated data set, and historical exposure subgraph update results, the data supply boundary for similar access requests is updated to form the data supply boundary update result;

[0327] When generating the data supply boundary update result, the privacy data units, object nodes, relationship edges, processing operators and output result formats that are actually used and participate in the completion of the current business task within the boundary are retained as data supply content that can be referenced by similar access requests.

[0328] Record out-of-bounds call content, data content that did not participate in the completion of the current business task, data content that was terminated, result content that was not allowed to be saved, and data content that caused the result flow to exceed the bounds as the data supply content that needs to be restricted for the same type of access request.

[0329] The data supply boundary update results are associated with the task completion condition set, the reconstructed task feature subgraph, the recovery link identification results, and the historical exposure subgraph update results to form the call handling record results.

[0330] refer to Figure 3 The data privacy protection system for e-commerce platforms based on big data includes the following modules:

[0331] The graph construction module is used to collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing on the multi-source heterogeneous data, generate a set of data objects, and construct a privacy-related graph based on the set of data objects.

[0332] The task parsing module is used to receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions based on the task dependency descriptions.

[0333] The candidate data supply module is used to search for data to supply candidate subgraphs in the privacy association graph, extract privacy data units, perform substitution processing, and generate candidate task feature subgraphs.

[0334] The link identification module is used to construct a historical exposure subgraph, overlay the candidate task feature subgraph and the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results.

[0335] The link reconstruction module is used to determine the key associated edge set based on the recovery link identification results, generate multiple link disconnection schemes, perform link reconstruction processing, and obtain the reconstruction task feature subgraph.

[0336] The execution domain generation module is used to remap the feature subgraph of the reconstruction task to the privacy association graph, re-identify the closed privacy recovery link, and generate a temporary restricted execution domain to obtain the temporary restricted execution domain configuration result.

[0337] The call handling module is used to open the restricted call interface corresponding to the temporary restricted execution domain, identify out-of-bounds call behavior, terminate the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, and generate call handling record results.

[0338] Example 1: To verify the feasibility of this invention in practice, it was applied to a data access and privacy protection scenario on an e-commerce platform. This platform simultaneously operates product browsing, keyword search, shopping cart, order transactions, online payment, logistics fulfillment, after-sales processing, customer service interaction, and user profile updates. Internally, the platform includes an operational analysis system, customer service system, risk control verification system, and logistics collaboration system that access data. In traditional processing methods, requesting entities typically access corresponding data tables based on role permissions. Although the platform anonymizes fields such as account, mobile phone number, address, payment order number, and logistics order number, it lacks unified correlation analysis of data content obtained by the same requesting entity in different business tasks, historical call results, and historical export results. This means that while a single access may appear to lack complete sensitive information, the cumulative results of multiple accesses can still potentially reveal user objects, behavioral trajectories, transaction relationships, or the basis for user profile tag formation.

[0339] In this scenario, the platform first incorporates registration data, login data, browsing data, search data, transaction data, payment data, logistics data, after-sales data, customer service interaction data, terminal usage data, and tag profile data into a unified processing scope. It then organizes field names, time formats, object identifiers, and business processes from different business systems, associating user objects, device objects, order objects, address objects, payment objects, logistics objects, behavior objects, and time objects that were originally scattered across multiple systems to form a data object set, which is further broken down into privacy data units. Subsequently, a privacy association graph is constructed based on the mapping relationships, co-occurrence relationships, continuous temporal relationships, and cross-business process transmission relationships between objects. This allows the platform to clearly see the connection methods between different data within the same business task, as well as how data already exposed between different business tasks generates new splicing relationships.

[0340] To verify the implementation effect, the results of similar data access tasks were compared using traditional processing methods and the present invention. Test data covered business processes including registration, login, browsing, searching, transactions, payment, logistics, after-sales service, customer service interaction, terminal usage, and tag profiling, involving a total of 1,260,000 data objects, 4,830,000 privacy data units, and 3,200 access request samples. The results show that, without reducing the completion rate of current business tasks, the present invention significantly reduces the amount of detailed-level privacy data exposed and the number of closed privacy recovery chains formed by historical exposed data and current supplied data. Under traditional processing methods, even after a single access permission verification passes, there are still many risks of cross-business process splicing, especially in operational analysis, customer service collaboration, and logistics query tasks, where situations where historical exported results and currently returned data together form a closed chain of transaction relationships are more concentrated. This invention reduces the number of closed privacy recovery links from a high level to a low level through historical exposure subgraph overlay identification and link reconstruction processing. At the same time, the temporary restricted execution domain can record out-of-bounds calls and terminate out-of-task calls in a timely manner, so that the data supply boundary can be continuously updated with the actual exposed content.

[0341] Table 1 Comparison of the implementation effects of this invention applied to data access tasks on e-commerce platforms

[0342] Comparison Projects Traditional processing methods After adopting the present invention Changes Test access request count 3200 times 3200 times Sample consistency Number of data objects involved 1,260,000 1,260,000 Consistent data range Number of privacy data units involved 4,830,000 4,830,000 Consistent data range Average number of privacy data units returned per task 186 74 Reduced by 112 Average number of detailed level identifiers returned 31 6 Reduce by 25 Average number of times content returned at precise time 42 11 31 fewer Average number of contents returned at precise addresses 18 pcs 3 Reduce by 15 Average number of detailed amount items returned 27 8 19 fewer Average number of stable mapping relationships retained across business processes 16 articles 4 12 fewer Number of closed privacy recovery links identified before reconstruction Unidentified 684 New recognition capabilities Number of residual closed privacy recovery links after link reconstruction and verification Unidentified 79 articles Residual links do not enter temporary restricted execution domains Number of unique link remnants of target object Unidentified 18 articles Residual links do not enter temporary restricted execution domains Behavioral sequences can correspond to the number of time-series link remnants. Unidentified 24 articles Residual links do not enter temporary restricted execution domains The number of remaining closed chains in the transaction relationship Unidentified 29 articles Residual links do not enter temporary restricted execution domains Image tags can be used to infer the number of residual relationships. Unidentified 8 Residual links do not enter temporary restricted execution domains Current business task completion rate 98.6% 98.1% Decrease by 0.5 percentage points Average interface response time 412 milliseconds 486 milliseconds Increased by 74 milliseconds Number of outbounded call recognitions Unidentified 137 times New recognition capabilities Number of Temporarily Restricted Execution Domain Termination Triggers Not executed 137 times Consistent with the number of outbound call recognitions Number of historical exposed subgraph updates Not built 3200 times Update after each access task is completed Number of similar access requests to update data boundaries Not updated 2864 times Covering 89.5% of access requests

[0343] As can be seen from the table above, this invention significantly improves upon traditional methods in several key indicators of data access and privacy protection on e-commerce platforms. Regarding data exposure control, the average number of privacy data units returned per task under traditional methods is 186, while this invention reduces it to 74, a reduction of 112. The average number of detailed identifiers returned is reduced from 31 to 6, the average number of precise time entries from 42 to 11, the average number of precise address entries from 18 to 3, the average number of detailed amount entries from 27 to 8, and the average number of stable mapping relationships retained across business processes from 16 to 4. This demonstrates that this invention can reduce the output range of detailed data, direct identifier data, and stable cross-business process associations while ensuring task completion.

[0344] Regarding privacy recovery risk identification, traditional methods do not overlay historical exposure data and current data supply for analysis, thus failing to identify closed privacy recovery links. Using this invention, the system identifies 684 closed privacy recovery links before reconstruction, and through link reconstruction and verification, reduces the number of residual closed privacy recovery links to 79. Furthermore, the candidate task feature subgraphs corresponding to the residual links do not enter the temporarily restricted execution domain. Among these, 18 are residual links for unique target objects, 24 are residual links for behavior sequences corresponding to time sequences, 29 are residual links for transaction relationships that can be closed, and 8 are residual links for profile tags that can be used to infer relationships. This demonstrates that this invention can classify, identify, and handle risks related to identity recovery, behavior trajectory recovery, transaction relationship recovery, and profile inference.

[0345] Regarding business availability, the current business task completion rate using the traditional processing method is 98.6%, while it is 98.1% after adopting this invention, a decrease of only 0.5 percentage points. This indicates that this invention can maintain a high business task completion rate while reducing privacy data exposure and shortening recovery links. In terms of system overhead, the average interface response time increased from 412 milliseconds to 486 milliseconds, an increase of 74 milliseconds. This change corresponds to the processes of privacy association graph overlay, recovery link identification, link reconstruction, and temporary restricted execution domain generation, and is considered an acceptable processing overhead.

[0346] Regarding access control, traditional methods fail to identify out-of-bounds calls and do not construct historical exposure subgraphs or data supply boundaries for similar access requests. After adopting this invention, the system identified 137 out-of-bounds calls and triggered temporary restricted execution domain termination 137 times, matching the number of instances. The historical exposure subgraph was updated 3200 times, consistent with the number of test access requests. The data supply boundaries for similar access requests were updated 2864 times, covering 89.5% of the access requests. These results demonstrate that this invention can extend single-access control to a continuously updated exposure state management and data supply boundary adjustment mechanism, thereby improving the continuity and controllability of data privacy protection processes on e-commerce platforms.

[0347] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A data privacy protection method for e-commerce platforms based on big data, characterized in that: Includes the following steps: Collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing on the multi-source heterogeneous data, generate a set of data objects, and construct a privacy association graph based on the set of data objects; Receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions based on the task dependency descriptions; In the privacy association graph, search data is fed into candidate subgraphs, privacy data units are extracted, and substitution processing is performed to generate candidate task feature subgraphs; Construct a historical exposure subgraph, overlay the candidate task feature subgraph with the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results; Based on the results of link recovery identification, the key associated edge set is determined, multiple link disconnection schemes are generated, link reconstruction processing is performed, and the feature subgraph of the reconstruction task is obtained. The reconstructed task feature subgraph is remapped into the privacy association graph, the closed privacy recovery link is re-identified, and a temporary restricted execution domain is generated to obtain the temporary restricted execution domain configuration result. Open the restricted call interface corresponding to the temporary restricted execution domain, identify out-of-bounds call behavior, terminate the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, and form a call handling record result.

2. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The preprocessing includes field unification, time alignment, association identifier normalization, and business process aggregation.

3. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The task completion condition set includes data object category, inter-object relationship, result accuracy range, time span, and result flow boundary.

4. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The process of searching data in the privacy association graph to supply candidate subgraphs, extracting privacy data units, and performing substitution processing to generate candidate task feature subgraphs specifically includes: A candidate search range is formed based on the task completion condition set, and the starting object node and target object node of the current business task are determined within the candidate search range. Using the starting object node and the target object node as search endpoints, a path search is performed in the privacy association graph to obtain multiple data supply candidate subgraphs; For each data supply candidate subgraph, perform task condition matching processing to form a set of candidate data supply subgraphs; For each candidate data supply subgraph in the candidate data supply subgraph set, extract privacy data units; The directly related privacy data units are sorted out and stratified by sensitivity to obtain high-sensitivity privacy data units, related-sensitivity privacy data units, and low-sensitivity privacy data units. For highly sensitive privacy data units, substitutability judgment, low-sensitivity substitution processing, and task availability organization are performed to form a candidate task feature subgraph.

5. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The construction of the historical exposure subgraph, which overlays the candidate task feature subgraph with the historical exposure subgraph onto the privacy association graph, identifies closed privacy recovery links, and obtains the recovery link identification results, specifically includes: Read the data content already obtained by the requesting subject, historical call results, historical export results and corresponding exposure granularity information, and collect them according to the requesting subject identifier to form a historical exposure basic data set; The historical exposure baseline data set is sorted out and its contents are extracted to form a historical exposure mapping data set; Based on the exposure granularity information in the historical exposure basic dataset, the historical exposure mapping dataset is granularized and labeled to form a granularized exposure dataset. A historical exposure subgraph is constructed based on the granularity-labeled exposure dataset, and combined with the candidate task feature subgraph to form a closed-loop data set; The data closed-loop set is subjected to target object unique link identification to form a target object unique link set; By identifying the behavioral sequence corresponding to the time-series link in the closed-loop data set, a set of behavioral sequences corresponding to the time-series links can be formed. The transaction relationship can be closed-looped by identifying closed-loop chains in the data closed-loop set, thus forming a set of transaction relationship closed-loop chains; By performing profile tagging on the closed-loop data set, a profile tagging set that can be inferred from the relationship can be formed. The unique link set of the target object, the time sequence link set that the behavior sequence can correspond to, the closed chain set of transaction relationship, and the reverse relationship set that the profile tag can infer are organized to form the recovery link identification result.

6. The data privacy protection method for e-commerce platforms based on big data according to claim 5, characterized in that, The construction of a historical exposure subgraph based on the granularity-labeled exposure dataset, combined with the candidate task feature subgraph, to form a data closed-loop set specifically includes: Construct a historical exposure subgraph corresponding to the request subject based on the granularity-labeled exposure data set; Read the candidate task feature subgraph and map the retained privacy data units, replaced privacy data units, and replaced low-sensitivity privacy data units in the candidate task feature subgraph to the corresponding object nodes and relation edges in the privacy association graph, respectively, to form the candidate task feature mapping subgraph. The candidate task feature mapping subgraph and the historical exposure subgraph are overlaid and mapped onto the privacy association graph to form an overlaid association graph oriented towards the current access request; In the overlay association graph, key association edges are identified to form a set of key association edges; Link tracing is performed on the overlay association graph along the key association edges in the key association edge set to form a data closed loop set.

7. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The process of determining key associated edge sets based on the restored link identification results, generating multiple link disconnection schemes, performing link reconstruction processing, and obtaining the reconstruction task feature subgraph specifically includes: Based on the recovery link identification results, a set of recovery links to be reconstructed is formed. The link structure of each closed privacy recovery link in the set of recovery links to be reconstructed is organized to form a recovery link structure description result. Based on the description of the recovery link structure, determine the set of key associated edges that enable the closed privacy recovery link to be established; For each key associated edge in the key associated edge set, perform cut-off method matching to generate cut-off method matching results; Multiple link disconnection schemes are generated based on the disconnection method matching results, forming a link disconnection scheme set; For each link disconnection scheme in the set of link disconnection schemes, perform task completion condition preservation calculation, closed privacy restoration link release calculation, and modification cost calculation to form task completion condition preservation result, restoration link release result, and modification content description result; Based on the results of maintaining the task completion conditions, the results of restoring the link release, and the description of the changes, the set of link disconnection schemes is filtered to form a set of available link disconnection schemes; Sort the available link disconnection schemes in the set of available link disconnection schemes to form the target link disconnection scheme; Based on the target link disconnection scheme, link reconstruction processing is performed on the candidate task feature subgraph to form an initial reconstruction task feature subgraph. The object nodes and relation edges in the initial reconstruction task feature subgraph are consistent and organized to form a consistent reconstructed reconstruction task feature subgraph. Based on the task completion condition set, the output content of the consistency sorting and reconstruction task feature subgraph is sorted to form the reconstruction task feature subgraph.

8. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The specific steps of remapping the reconstructed task feature subgraph to the privacy association graph, re-identifying the closed privacy recovery link, and generating a temporary restricted execution domain to obtain the temporary restricted execution domain configuration result include: Based on the feature subgraph of the reconstruction task, a set of reconstructed feature verification data is formed, and the set of reconstructed feature verification data is mapped to the privacy association graph to form a feature mapping subgraph of the reconstruction task. The reconstructed task feature mapping subgraph and the historical exposure subgraph are overlaid and mapped onto the privacy association graph to form a reconstructed overlay association graph; In the reconstructed overlay association graph, the set of key association edges for reconstruction is determined, and link tracing is performed along the key association edges in the set of key association edges for reconstruction to form a closed loop set of reconstructed data. A closed-loop privacy recovery link is verified on the reconstructed data closed-loop set to generate a reconstructed recovery link verification result. Based on the reconstructed recovery link re-verification results, an unrecoverable re-verification result is generated. Based on the task completion condition set, the task completion of the reconstructed task feature subgraph is verified to form a task completion verification result. Based on the irreversible re-verification results and the task completion verification results, the execution domain generates a judgment result. Based on the execution domain, a basic subgraph is generated, forming an execution domain data mount set, and a restricted data view result is generated based on the execution domain data mount set; Based on the task completion condition set, determine the processing operator constraint result, the output result template constraint result, and the access and usage boundary constraint result; Based on the results of the restricted data view, the results of the processing operator constraints, the results of the output result template constraints, and the results of the access and use boundary constraints, a temporary restricted execution domain is generated, forming the temporary restricted execution domain configuration result.

9. The data privacy protection method for e-commerce platforms based on big data according to claim 1, characterized in that, The restricted call interface corresponding to the open temporary restricted execution domain identifies out-of-bounds call behavior and terminates the temporary restricted execution domain when the current business task is completed, the access period expires, or an out-of-bounds call occurs, forming a call handling record result that specifically includes: A restricted call configuration set is formed based on the temporary restricted execution domain configuration results. Restricted call interfaces are then opened based on the restricted call configuration set, resulting in restricted call interface results. When the result of the restricted call interface is invoked, the interface call detail data set is collected, and the interface call detail data set is compared with the restricted call configuration set to form the call boundary verification result; Generate call record results based on the API call details data set and call boundary verification results; Based on the call record results, identify the task completion status and call termination conditions of the current business task, and form a task termination judgment result; Based on the task termination judgment result, the temporary restricted execution domain is terminated, resulting in a temporary restricted execution domain termination result. Extract the actual exposed content from the call log results and the termination results of the temporary restricted execution domain to form an updated data set of exposure results; Update the historical exposure submap based on the exposure results update dataset to form the historical exposure submap update result; Based on the call record results, exposure results, updated data set, and historical exposure subgraph update results, the data supply boundary for similar access requests is updated to form the data supply boundary update result; The data supply boundary update results are associated with the task completion condition set, the reconstructed task feature subgraph, the recovery link identification results, and the historical exposure subgraph update results to form the call handling record results.

10. The data privacy protection system for e-commerce platforms based on big data according to claim 1, characterized in that, The data privacy protection method for e-commerce platforms based on big data as described in any one of claims 1 to 9 is characterized by comprising the following modules: The graph construction module is used to collect multi-source heterogeneous data from e-commerce platforms, perform preprocessing, generate a set of data objects, and construct a privacy-related graph. The task parsing module is used to receive access requests for target data, generate task dependency descriptions, and generate a set of task completion conditions. The candidate data supply module is used to search for data to supply candidate subgraphs in the privacy association graph, extract privacy data units, perform substitution processing, and generate candidate task feature subgraphs. The link identification module is used to construct a historical exposure subgraph, overlay the candidate task feature subgraph and the historical exposure subgraph onto the privacy association graph, identify closed privacy recovery links, and obtain the recovery link identification results. The link reconstruction module is used to determine the key associated edge set based on the recovery link identification results, generate multiple link disconnection schemes, perform link reconstruction processing, and obtain the reconstruction task feature subgraph. The execution domain generation module is used to remap the feature subgraph of the reconstruction task to the privacy association graph, re-identify the closed privacy recovery link, and generate a temporary restricted execution domain. The call handling module is used to open the restricted call interface corresponding to the temporary restricted execution domain. When the current business task is completed, the access period expires, or an out-of-bounds call occurs, the temporary restricted execution domain is terminated, and the call handling record result is generated.

Images