An e-commerce platform user information desensitization processing system

Abstract

The application discloses an e-commerce platform user information desensitization processing system, relates to the technical field of data processing and information security, and acquires order data containing a commodity SKU code and user sensitive information through an order data acquisition module, determines a commodity category label associated with the order through a category mapping module, matches a corresponding privacy risk level through a privacy risk knowledge base, selects a target desensitization strategy according to the strategy matching module, and executes a field-level desensitization operation through a desensitization processing module. The system of the application also supports multi-dimensional risk assessment, mixed order risk determination and time-effectiveness dynamic desensitization, realizes fine and differentiated protection of user information, and simultaneously considers business development requirements and the scalability and auditability of the system.

Description

Technical Field

[0001] This invention relates to the fields of data processing and information security technology, specifically to a user information de-identification processing system for e-commerce platforms. Background Technology

[0002] With the rapid development of e-commerce, e-commerce platforms generate and store massive amounts of user personal information during transactions, including sensitive data such as names, mobile phone numbers, and shipping addresses. How to effectively protect user privacy while ensuring normal business operations has become a pressing technical problem for e-commerce platforms. Data anonymization technology, through processes such as replacement, masking, and encryption of sensitive information, reduces the risk of privacy leaks while retaining the data's usability, and is currently a widely adopted technical approach.

[0003] In the prior art, invention patent CN120493297B discloses a privacy-protected e-commerce user profile design method. This scheme performs data classification, sensitive data categorization, and sensitive data identification on user data of e-commerce platforms, and adopts different de-identification rules according to different layer labels, including static de-identification and dynamic de-identification. The de-identification strategy selection of this scheme is based on the data's own security layer labels. Invention patent CN116432243B discloses a data de-identification method, apparatus, device, and storage medium for online shopping malls. This scheme matches a pre-built membership weight model according to the user type corresponding to the query request, and performs data de-identification on the transaction order table according to the membership weight. The de-identification strategy selection of this scheme is based on the visitor's user type.

[0004] In the aforementioned existing technologies, the triggering basis for de-identification strategies is based on the attributes of the data itself or the attributes of the visitor, which shares a common limitation: when the same user purchases different categories of goods, even if the data structure of each order is exactly the same (all containing name, mobile phone number, and shipping address), the de-identification system will apply the same de-identification strategy to all orders. However, in the business practice of e-commerce platforms, the privacy sensitivity and consequences of leakage of user information in orders generated by users purchasing different categories of goods vary significantly. For example, although the order information generated by a user purchasing Class I medical devices (such as blood glucose test strips) and the order information generated by a user purchasing daily necessities (such as cleaning products) both consist of name, mobile phone number, and shipping address at the data level, the former involves user health privacy, and the harm caused to the user by information leakage is far greater than that of the latter. Existing technologies cannot perceive the differences in privacy risks brought about by the product categories associated with an order. Therefore, at the level of de-identification strategies, it is impossible to achieve differentiated protection for different categories of orders, resulting in insufficient protection of user information for high-risk categories or excessive sacrifice of the usability of user information for low-risk categories. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and provide an e-commerce platform user information de-identification processing system. This system can automatically identify the privacy risk level based on the product category associated with the order and adaptively select the de-identification strategy to achieve refined and differentiated protection of user information, while taking into account both strict privacy protection for high-risk product category orders and data availability for low-risk product category orders.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a user information de-identification processing system for e-commerce platforms, the system comprising: The order data acquisition module is used to acquire order data generated by the e-commerce platform. The order data includes product SKU codes and user sensitive information fields. The category mapping module stores the mapping relationship between product SKU codes and product category tags, and is used to determine the product category tags associated with an order based on the product SKU code; The privacy risk knowledge base stores the privacy risk levels corresponding to various product category tags. The strategy matching module is used to obtain the corresponding privacy risk level from the privacy risk knowledge base based on the product category tags associated with the order, and determine the target de-identification strategy from the preset de-identification strategy set based on the privacy risk level. The desensitization module is used to perform desensitization processing on the user sensitive information fields using the target desensitization strategy.

[0007] By setting up a category mapping module and a privacy risk knowledge base, the de-identification system can automatically identify product category tags based on the product SKU codes in the order and obtain the corresponding privacy risk level for that category. The strategy matching module automatically selects a matching de-identification strategy based on the privacy risk level to differentiate the processing of user sensitive information. Compared to the existing technology that uses a uniform de-identification strategy for all orders, this solution achieves adaptive de-identification rule selection based on product category semantics. It automatically increases the information protection strength when users purchase high-risk product categories and maintains high data availability when purchasing low-risk product categories, solving the technical problem that existing de-identification systems cannot perceive the differences in privacy risks between different product categories.

[0008] Furthermore, the privacy risk knowledge base also stores scores for multiple privacy risk dimensions corresponding to each product category tag. These multiple privacy risk dimensions include at least two of the following: health privacy relevance, home address exposure risk, social relationship exposure, spending power exposure, behavioral preference exposure, minor protection relevance, and occupational relevance. The privacy risk level is determined based on a comprehensive score of multiple privacy risk dimensions.

[0009] By introducing a multi-dimensional risk scoring mechanism into the privacy risk knowledge base, encompassing dimensions such as health privacy relevance, home address exposure risk, and social relationship exposure risk, and comprehensively evaluating the scores of each dimension to determine the privacy risk level, the selection of de-identification strategies no longer relies solely on a single data layer or user role. Instead, it comprehensively considers multiple privacy risk factors associated with the ordered goods. This multi-dimensional risk assessment approach makes the decision-making process for de-identification intensity more precise and objective, avoiding a one-size-fits-all approach to protection and enabling tailored, differentiated protection for the privacy characteristics of different product categories.

[0010] Furthermore, when an order contains multiple different product SKU codes, the category mapping module is used to obtain the product category tag corresponding to each product SKU code, and the strategy matching module is used to obtain the privacy risk level and the score of each privacy risk dimension corresponding to each product category tag from the privacy risk knowledge base, and determine the highest privacy risk level as the overall privacy risk level of the order, and determine the highest value of the score of each privacy risk dimension as the overall score of the order in that dimension. The target de-identification strategy is determined based on the overall privacy risk level and the overall score.

[0011] By implementing a "highest risk" principle in mixed order scenarios, when a single order contains multiple product categories, the system automatically selects the category with the highest risk level as the protection benchmark for the entire order, and uses the highest score across all risk dimensions as the overall dimensional score for the order. This mechanism effectively prevents the protection level of user information for high-risk product categories in mixed orders from being reduced due to the presence of low-risk categories. It ensures that the protection level of all personal information in a single order is no lower than the protection standard required for the category with the highest privacy risk in the order, thus plugging potential technical loopholes that allow for the circumvention of anonymization protection by combining products.

[0012] Furthermore, the strategy matching module is specifically used for: Obtain the privacy risk level and scores for each privacy risk dimension corresponding to the product category tags associated with the order in the privacy risk knowledge base; Iterate through each candidate desensitization strategy in the set of desensitization strategies. Each candidate desensitization strategy is pre-configured with risk level triggering conditions and dimension score triggering thresholds. Candidate desensitization strategies that meet the triggering conditions are identified as target desensitization strategies; When multiple candidate desensitization strategies meet the triggering conditions simultaneously, the target desensitization strategy is selected according to a preset priority rule. The preset priority rule is that health privacy relevance takes precedence over social relationship exposure, social relationship exposure takes precedence over home address exposure risk, and home address exposure risk takes precedence over spending power exposure.

[0013] By pre-configuring risk level trigger conditions and dimension score trigger thresholds for each candidate strategy in the anonymization strategy set, and setting a priority ranking rule based on the highest correlation between health and privacy and the lowest exposure to spending power, the optimal strategy can be accurately selected according to preset logic when multiple strategies simultaneously meet the trigger conditions. This priority rule is designed based on the practical consideration that the consequences of health and privacy leaks are more severe than those of spending power exposure in e-commerce business practices. It ensures that the system can make strategy decisions that meet actual privacy protection needs when facing complex orders with overlapping multi-dimensional risks, enhancing the automated decision-making capability and consistency of strategy selection in the anonymization system.

[0014] Furthermore, the set of desensitization strategies includes a time-sensitive control desensitization strategy, which sets a first desensitization granularity and a second desensitization granularity for the address field in the user sensitive information field, and configures time-sensitive switching conditions. The desensitization processing module is used to desensitize the address field using the first desensitization granularity when the timeliness switching condition is not met, and automatically switches to desensitizing the address field using the second desensitization granularity after the timeliness switching condition is met. The information exposure degree of the second desensitization granularity is lower than that of the first desensitization granularity.

[0015] By introducing a timeliness control mechanism into the set of de-identification strategies, two de-identification granularities with different levels of information exposure are set for the address field, and timeliness switching conditions are configured. This allows the system to provide sufficiently detailed address information during delivery to ensure the normal execution of logistics operations, and automatically switch to a higher-strength de-identification granularity after delivery to reduce the risk of leakage caused by long-term storage of address information. This mechanism resolves the contradiction between maintaining the availability of address information during business use and the need for strict protection after use in e-commerce delivery scenarios, achieving dynamic hierarchical protection of user address information throughout its entire lifecycle.

[0016] Furthermore, the desensitization processing module is also used to generate a time-limited access token associated with the user sensitive information field. The time-limited access token includes a token validity period and a maximum number of accesses. When the token is within its validity period and the current access count has not reached the maximum number of accesses, the desensitization processing module decrypts and returns the original user sensitive information field before desensitization based on the received token verification request. When the token expires or the current number of accesses reaches the maximum number of accesses, the time-sensitive access token becomes invalid, and the de-identification module prohibits decryption operations.

[0017] By introducing time-sensitive access tokens that include an expiration date and a maximum number of accesses, the system strictly controls authorized operations requiring temporary access to original user information. Authorizing parties can only decrypt and obtain plaintext data within the token's validity period and the allowed number of accesses. The token automatically expires after the expiration date or the access limit is reached. This mechanism provides fine-grained authorization control for temporary access to sensitive information, avoiding the security risks that may arise from long-term validity of authorization credentials. Simultaneously, the automatic management of token status reduces the operational risks and management burden associated with manual intervention.

[0018] Furthermore, the de-identification strategy set includes at least two field-level de-identification strategy templates: Address field masking strategy templates should include at least five granularity levels: full plaintext display, province / city / district visible with detailed address mask, province / city only visible, province only visible, and full mask. The mobile phone number field desensitization strategy template includes at least four granularity levels: the first three and last four digits are visible and the middle is masked; only the first three digits are visible and the rest are masked; full mask and the token is reversible; and full mask is irreversible. Name field anonymization strategy template should include at least four granularity levels: full name display, surname plus title mask, surname only display, and full mask. The target de-identification strategy is generated by combining at least one field-level de-identification strategy template.

[0019] By pre-setting various field-level masking strategy templates, such as address, phone number, and name, within the masking strategy set, and with each template containing multiple granularity options, the strategy matching module can flexibly generate target masking strategies for specific product categories and risk levels by combining strategy templates at different field levels. This modular strategy template design gives the masking strategy library excellent scalability. When the platform adds a new product category or needs to adjust the masking granularity of a certain field, only the corresponding strategy template needs to be modified or added, without reconstructing the entire masking strategy system, thus reducing system maintenance costs and expansion difficulty.

[0020] Furthermore, the time-sensitive switching condition includes a preset time elapsed after the order delivery and receipt event is triggered; Different product category tags correspond to different preset time lengths, which shorten as the privacy risk level of the corresponding product category tag in the privacy risk knowledge base increases.

[0021] By linking the preset time length in the delivery time switching conditions to the privacy risk level of the product category label, the waiting time for the address field of high-risk category orders before the high-intensity desensitization switch is shorter, while the waiting time for low-risk category orders is relatively longer. This differentiated delivery time setting allows user addresses for high-risk categories such as health and privacy issues to enter a high-protection state more quickly after delivery, shortening the exposure window of sensitive information. Addresses for low-risk categories, on the other hand, remain available for a longer period to meet potential after-sales inquiry needs, achieving a more refined balance between protection strength and business efficiency.

[0022] Furthermore, the system also includes an operation log recording module, which records the operation log for each de-identification process. The operation log includes the request timestamp, the system identifier of the request source, the order number, the identified product category tag, the obtained privacy risk level, the determined target de-identification strategy identifier, and the de-identification processing time. The operation log does not contain the plaintext of user sensitive information fields before the de-identification process.

[0023] By setting up an operation log recording module, key information for each de-identification process is recorded, including request timestamps, request source system identifiers, order numbers, product category tags, privacy risk levels, and de-identification policy identifiers. Simultaneously, it ensures that the logs do not contain plaintext versions of sensitive user information from before the de-identification process. This design makes the entire de-identification process traceable and auditable. In the event of a data security incident or when compliance reviews are required, the logs can be used to quickly locate problematic steps and operational records. Furthermore, the logs themselves do not store original sensitive data, preventing the log system from becoming a new source of data leakage.

[0024] Furthermore, the privacy risk knowledge base has a dynamic update interface for receiving and storing newly added product category tags and their corresponding privacy risk levels and scores for multiple privacy risk dimensions, or modifying the privacy risk levels and scores for multiple privacy risk dimensions corresponding to existing product category tags. The updated privacy risk knowledge base takes effect immediately in the subsequent anonymization processing of order data.

[0025] By configuring a dynamic update interface for the privacy risk knowledge base, the system can adapt to changes in product categories and evolving privacy protection needs on e-commerce platforms. When adding new product categories or adjusting the risk ratings of existing categories, data can be added, deleted, or modified directly through the interface. The updated data takes effect immediately in the de-identification process for all subsequent orders. This mechanism ensures the long-term availability and timeliness of the de-identification system. When a company expands into new product categories or legal regulations change the privacy protection requirements for specific product categories, policy adjustments can be made without modifying or redeploying the system code, reducing system maintenance costs.

[0026] Compared with existing technologies, this e-commerce platform user information desensitization processing system has the following beneficial effects: I. This invention introduces product category identification and multi-dimensional privacy risk assessment mechanisms into the de-identification process. It can automatically identify the corresponding privacy risk level based on the product category associated with the order and adaptively match differentiated de-identification strategies. This automatically increases the strength of information protection when users purchase high-privacy-risk product categories and retains high data availability when purchasing low-risk product categories. This solves the problem that existing technologies cannot implement refined protection for different product categories and effectively balances the core needs of user privacy security and business data usage.

[0027] Second, by setting a time-sensitive control desensitization strategy and a time-sensitive access token mechanism, this invention can automatically adjust the desensitization granularity of sensitive information according to the order business lifecycle. While ensuring the normal operation of logistics, distribution, after-sales processing and other businesses, it shortens the exposure window of sensitive information. At the same time, the system has complete operation log recording and dynamic update capabilities of privacy risk knowledge base, realizing auditability of the entire desensitization process. It can quickly adapt to product category updates and changes in privacy protection regulations, improving the long-term availability and operation and maintenance efficiency of the system.

[0028] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0030] Figure 1 This is a schematic diagram of the module architecture of the system of the present invention; Figure 2 This is a schematic diagram illustrating the data organization of the privacy risk knowledge base of this invention; Figure 3 This is a flowchart illustrating the timeliness control mechanism of the present invention. Detailed Implementation

[0031] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0032] Example This embodiment provides a user information anonymization system for e-commerce platforms. Deployed on the backend server of the e-commerce platform, this system is used to anonymize sensitive user information in business scenarios such as order generation, user query, customer service processing, and data analysis. The following detailed description, combined with actual e-commerce business scenarios and accompanying drawings, provides further insight. It should be noted that the specific product category names and risk score settings in the following embodiments are only used to explain the working principle of the invention and are not intended to limit the scope of protection.

[0033] In this embodiment, the e-commerce platform user information desensitization processing system runs as an independent middleware service, interacting with the e-commerce platform's order system, product management system, user center, logistics system, and customer service system through API interfaces.

[0034] The overall module composition and data flow of the system are as follows: Figure 1 As shown, the order data acquisition module receives a de-identification request from the order system, parses the order data, and passes it to the category mapping module. The category mapping module queries its internally stored SKU category tag mapping table to obtain the product category tags associated with the order. The output of the category mapping module connects to the policy matching module. The policy matching module connects to both the privacy risk knowledge base and the de-identification policy set. It reads the privacy risk level and scores for each risk dimension corresponding to the category from the privacy risk knowledge base, and then matches the corresponding de-identification policy combination from the de-identification policy set. The output of the policy matching module is passed to the de-identification processing module, which performs specific de-identification operations on the user's sensitive information fields. The de-identification processing module connects to the timeliness control submodule to manage the generation, verification, and automatic expiration of timeliness tokens. The operation log recording module connects to both the policy matching module and the de-identification processing module to record a complete log of the de-identification process. The de-identification processing module returns the de-identified data to the requesting business system through the data output interface.

[0035] The order data acquisition module receives order data containing the following fields: order number, user identifier, list of product SKU codes, recipient name, recipient mobile phone number, delivery address, and email address. Among these, the recipient name, recipient mobile phone number, delivery address, and email address are sensitive user information fields and are subject to anonymization processing by this system. Each SKU code in the product SKU code list is used for subsequent category identification.

[0036] The category mapping module is the system's foundational data module, its core being a SKU category label mapping table. This mapping table's data structure includes an SKU code field, a primary category field, a secondary category field, and a category label identifier field. Taking actual product data as an example, the records stored in the mapping table include: SKU code BX001 corresponds to the primary category of household appliances, the secondary category of large appliances, and the category label identifier "major_appliance"; SKU code XT002 corresponds to the primary category of Class I medical devices, the secondary category of testing reagents, and the category label identifier "medical_test"; SKU code LH003 corresponds to the primary category of gifts and flowers, the secondary category of fresh flowers and gifts, and the category label identifier "gift_flower"; SKU code RB004 corresponds to the primary category of daily necessities, the secondary category of cleaning products, and the category label identifier "daily_necessity"; SKU code ZB005 corresponds to... The product has the following categories: SKU HF006 (primary category: jewelry, secondary category: gold jewelry, category label: jewelry); SKU QC007 (primary category: car accessories, secondary category: car interiors, category label: auto_accessory); SKU YX008 (primary category: audio equipment, secondary category: Bluetooth speakers, category label: audio_device); and SKU DZ009 (primary category: electronic products, secondary category: smartwatches, category label: electronic_product). When an operator adds a new SKU in the backend, the system automatically creates a corresponding mapping record in the mapping table based on the product category it belongs to. If a SKU does not yet exist in the mapping table, the system marks it as an unknown category, uses a default desensitization strategy, and sends a category attribution setting prompt to the administrator.

[0037] The category mapping module's mapping table data comes from the e-commerce platform's existing product database. In daily operations, primary and secondary category information is maintained for each product SKU in the backend. The category mapping module retrieves the latest category data from the product management system through a periodic synchronization mechanism and converts it into the category tag format required by the system. This design eliminates the need for additional manual maintenance of the category mapping table and seamlessly integrates with the existing product management process.

[0038] The privacy risk knowledge base is one of the core modules of this system, and its structure and content are as follows: Figure 2As shown, the privacy risk knowledge base uses product category tags as the primary key, storing a set of privacy risk assessment data for each category. The assessment data includes a comprehensive privacy risk level and scores for multiple privacy risk dimensions. In this implementation, the privacy risk level is defined as four levels: low risk, medium risk, high risk, and extremely high risk. The privacy risk dimensions include seven dimensions: health privacy relevance, home address exposure risk, social relationship exposure, spending power exposure, behavioral preference exposure, minor protection relevance, and occupational relevance. Each dimension has a score range of 0 to 10, where 0 indicates the category is completely unrelated to that risk dimension, and 10 indicates the category is highly relevant to that risk dimension.

[0039] Taking the actual product categories as an example, the typical records stored in the privacy risk knowledge base are as follows: The first category of medical devices, corresponding to the category label "medical_test," is classified as extremely high risk. The scores for each dimension are as follows: Health Privacy Relevance 10 points, Home Address Exposure Risk 5 points, Social Relationship Exposure 0 points, Spending Power Exposure 3 points, Behavioral Preference Exposure 5 points, Minor Protection Relevance 1 point, and Occupation Relevance 2 points. The reason for the 10-point score in Health Privacy Relevance is that users' purchase of Class I medical device products such as blood glucose test strips, HIV test strips, and pregnancy tests directly reflects their health status or physical characteristics; the leakage of such information would cause significant harm to users.

[0040] The gift flower category, tagged with "gift_flower," is classified as high-risk. Its scores across various dimensions are as follows: Health and Privacy Relevance 0 points, Home Address Exposure Risk 3 points, Social Relationship Exposure 10 points, Spending Power Exposure 5 points, Behavioral Preference Exposure 4 points, Minor Protection Relevance 0 points, and Occupation Relevance 0 points. The reason for the 10-point score in Social Relationship Exposure is that this category involves gift-giving scenarios, and the recipient information in the order is often not the buyer. Leaking order data would simultaneously expose the social relationship between the buyer and the recipient.

[0041] The major appliance category, tagged with "major_appliance," is classified as high-risk. The scores across the various dimensions are as follows: Health and Privacy Relevance: 0 points; Home Address Exposure Risk: 8 points; Social Relationship Exposure: 1 point; Spending Power Exposure: 7 points; Behavioral Preference Exposure: 2 points; Minor Protection Relevance: 0 points; Occupation Relevance: 0 points. The reason for the high home address exposure risk score of 8 points is that this category requires door-to-door delivery and installation, necessitating a precise address down to the house number. Furthermore, the long lifespan of large appliances increases the risk of leakage due to the long-term retention of address information. The reason for the high spending power exposure score of 7 points is that this category has a relatively high unit price, and purchasing behavior can reflect a user's economic level to some extent.

[0042] The daily necessities category, tagged with "daily_necessity," has a low risk level. Its scores across the dimensions are as follows: Health and Privacy Relevance 0 points, Home Address Exposure Risk 1 point, Social Relationship Exposure 0 points, Spending Power Exposure 1 point, Behavioral Preference Exposure 1 point, Minor Protection Relevance 0 points, and Occupation Relevance 0 points. The reason for the low scores across all dimensions in this category is that daily necessities are generic goods, and purchasing behavior hardly reflects the user's personal privacy characteristics.

[0043] The plastic products category, labeled plastic_product, is classified as low-risk. All dimensions score no higher than 2 points, similar to the daily necessities category, classifying it as a low-privacy-sensitive category.

[0044] The home furnishings category, labeled "home_supply," is classified as medium risk. Scores for each dimension are as follows: Health and privacy relevance 0 points, home address exposure risk 5 points, social relationship exposure 1 point, spending power exposure 4 points, behavioral preference exposure 3 points, minor protection relevance 1 point, and occupational relevance 0 points.

[0045] The clothing and apparel category, labeled "clothing," is classified as low-risk. Overall scores across all dimensions are low, with behavioral preference exposure ranging from 3 to 5 points, and relevance to minor protection from 1 to 2 points. Specific scores may vary depending on the clothing's style and target customer group.

[0046] The stationery category, labeled "stationery," is classified as low-risk. While overall scores across all dimensions are low, the score for relevance to the protection of minors is relatively high at 7 points, likely due to the close connection between stationery and minors' learning activities.

[0047] The paper products category, corresponding to the category label "paper_product", has a low risk level, with scores in each dimension not exceeding 2 points.

[0048] The automotive accessories category, tagged with "auto_accessory," is classified as medium risk. Its consumer spending exposure score is 6, because purchasing this category implies vehicle ownership, indirectly reflecting the user's asset status.

[0049] The audio equipment category, tagged with "audio_device," is classified as medium risk. Its consumer spending capacity exposure score ranges from 5 to 7, with the specific score varying depending on the product price.

[0050] The electronic products category, labeled electronic_product, is classified as medium risk. Its consumer exposure score ranges from 5 to 8, with the specific score varying depending on the product price.

[0051] The bag category, labeled "luggage," is classified as medium risk. Its consumer spending capacity exposure score is 4 to 7.

[0052] The category of medical protective equipment, labeled "medical_ppe," is classified as high-risk. It scores 4 points for health and privacy relevance and 7 points for occupational relevance. The high occupational relevance score is because purchasing this type of protective equipment suggests the purchaser may work in a medical-related profession or be in a high-risk work environment.

[0053] The jewelry category, labeled "jewelry," is classified as high-risk. Its consumer spending exposure score is 9, and its home address exposure risk score is 6.

[0054] The scores and risk levels for each dimension in the privacy risk knowledge base are assigned by the operations team and legal compliance personnel during system initialization. This assignment process references the current laws and regulations regarding the definition of sensitive personal information and incorporates the company's operational experience across various business categories, as well as actual user privacy complaint cases. The knowledge base supports dynamic updates. When a company launches new product categories or when legal regulations change the privacy protection requirements for specific product categories, administrators can add, delete, or modify the relevant evaluation data through the knowledge base's dynamic update interface. The updated data immediately takes effect in the de-identification process for all subsequent orders, without requiring modification or redeployment of the system code.

[0055] The de-identification strategy collection stores various preset de-identification strategy templates for the strategy matching module to use. These templates are organized by field type, with each field type containing multiple granularity levels of de-identification options. Specifically, the address field de-identification strategy template includes five granularity levels: Level 1 is full plaintext display with no de-identification; Level 2 is province, city, and district visible with detailed address masking, retaining the province, city, and district / county administrative division names in plaintext, while replacing the detailed address number with masked characters; Level 3 is province and city visible only, retaining the province and city names, while replacing the district / county and detailed address with masked characters; Level 4 is province visible only, retaining only the province name; and Level 5 is full masking, replacing the entire address field with masked characters.

[0056] The mobile phone number field desensitization strategy template includes four granularity levels: Level 1 is where the first three and last four digits are visible, and the middle four digits are masked, replacing the 4th to 7th digits of the 11-digit mobile phone number with mask characters; Level 2 is where only the first three digits are visible, and the rest are masked; Level 3 is a full mask with a reversible token, encrypting and storing the entire mobile phone number, which can only be decrypted and retrieved in plaintext through a time-sensitive access token; Level 4 is an irreversible full mask, replacing the mobile phone number with mask characters that cannot be recovered.

[0057] The name field anonymization strategy template includes four granularity levels: Level 1 displays the full name; Level 2 adds a title mask to the surname, retaining the surname and replacing the given name with a title; Level 3 displays only the surname; and Level 4 completely masks the entire name, replacing it with a preset anonymous identifier.

[0058] The strategy matching module works as follows: It receives the product category tags associated with the order from the category mapping module. Using these tags as the query key, it searches the privacy risk knowledge base to obtain the corresponding privacy risk level and scores for each dimension. The module then iterates through the candidate de-identification strategies in the de-identification strategy set. Each candidate strategy has pre-configured trigger conditions, including risk level conditions and dimension score threshold conditions. The module compares the current order's risk level and dimension scores with the trigger conditions of each candidate strategy, identifying the candidate strategy that meets all trigger conditions as the target de-identification strategy. When multiple candidate strategies simultaneously meet the trigger conditions, the module selects the final target de-identification strategy according to a preset priority rule. The preset priority rule is: health privacy relevance condition takes precedence over social relationship exposure condition, social relationship exposure condition takes precedence over home address exposure risk condition, and home address exposure risk condition takes precedence over spending power exposure condition.

[0059] For example, an order is associated with a Class I medical device product, labeled "medical_test," with an extremely high risk level and a health privacy relevance score of 10. The strategy matching module searches the desensitization strategy set for candidate strategies with a risk level equal to extremely high risk and a health privacy relevance score of 8. Upon successful matching, the target desensitization strategy is determined as follows: the mobile phone number field uses a full mask with a reversible token, with a maximum access count of 3; the address field uses a full mask with a reversible token, with the token validity period set to 24 hours after delivery confirmation; and the name field uses a surname plus title mask strategy. The parameter settings of this target desensitization strategy reflect a high level of protection for health privacy: the access count of the mobile phone number token is strictly limited, the address token validity period is short, and the address information enters an irreversible fully masked state 24 hours after delivery is completed.

[0060] In another example, an order is associated with the product category of daily necessities, tagged with "daily_necessity," and classified as low risk. The strategy matching module matches the following de-identification strategies: the phone number field uses a strategy where the first three and last four digits are visible while the middle four digits are masked; the address field uses a strategy where the province, city, and district are visible while the detailed address is masked; and the name field uses a strategy that displays the full name. This combination of strategies provides basic privacy protection while maintaining high data availability, meeting the business needs of low-risk product category orders for delivery efficiency and after-sales service.

[0061] The desensitization module receives the target desensitization strategy combination output by the strategy matching module and the user sensitive information fields transmitted by the order data acquisition module, and performs desensitization operations field by field. The desensitization module includes a masking submodule, an encryption submodule, and a replacement submodule. The masking submodule replaces the characters at corresponding positions in the sensitive fields with mask characters according to the mask granularity and mask position specified in the target desensitization strategy. The encryption submodule encrypts sensitive fields that require reversible recovery using the AES-256-GCM symmetric encryption algorithm, generating ciphertext and a corresponding time-sensitive access token. The replacement submodule replaces the entire content of the sensitive fields with a preset universal value.

[0062] The timeliness control submodule connected to the desensitization processing module is a key component for this system to achieve timeliness-based desensitization protection. For example... Figure 3 As shown, the workflow of the timeliness control submodule is as follows: When the desensitization module performs encryption on a sensitive field, it simultaneously calls the timeliness control submodule to generate a timeliness access token. The data structure of this timeliness access token includes a unique token identifier, associated order number, encrypted original data ciphertext, token validity start time, token expiration deadline, maximum number of accesses, current number of accesses, and a list of authorized roles. The unique token identifier is generated using the UUIDv4 standard to ensure global uniqueness. The token expiration deadline is set according to the timeliness parameters configured in the target desensitization strategy, specifically the order delivery and receipt time plus a preset time length. Different product category labels correspond to different preset time lengths: 24 hours for Class I medical devices, 48 ​​hours for large appliances, 36 hours for gifts and flowers, and 168 hours for daily necessities. The maximum number of accesses also varies by category: 3 times for Class I medical devices, 10 times for large appliances, 5 times for gifts and flowers, and 20 times for daily necessities.

[0063] When an authorized role submits a token verification request to the de-identification processing module through the business system, the timeliness control submodule performs the following verification steps: checks if the token status is valid, checks if the current system time is between the token's effective start time and expiration deadline, checks if the current access count is less than the maximum accessible count, and checks if the requesting role belongs to the authorized role list. If all checks pass, the timeliness control submodule uses the decryption key stored in the system to decrypt the encrypted data in the token, returns the original plaintext data to the de-identification processing module, and increments the current access count by 1. If any of the above checks fail, the decryption request is rejected, and the reason for rejection is recorded in the operation log. When the token's expiration deadline arrives, the timeliness control submodule automatically updates the token status to expired, and any subsequent decryption requests using this token are rejected. Simultaneously, the timeliness control submodule notifies the de-identification processing module to switch the de-identification strategy for this sensitive field from reversible to irreversible, replacing the encrypted ciphertext data with mask characters to complete the permanent de-identification of this field.

[0064] The timeliness control submodule uses a built-in timed task scheduler to automatically monitor and handle token expiration events. The timed task scheduler scans the token database at preset time intervals for all valid tokens, compares the current system time with the token's expiration deadline, and performs the automatic expiration and desensitization strategy switching operations on expired tokens. The execution frequency of this timed task can be flexibly configured according to system load.

[0065] The operation log recording module automatically records one operation log entry after each data masking process is completed. The operation log includes the following fields: request timestamp, accurate to milliseconds; request source system identifier, used to distinguish different callers such as the order system, customer service system, user center, and data analysis system; order number; identified product category tag; risk level and scores for each dimension obtained from the privacy risk knowledge base; identifier of the target data masking strategy finally matched by the strategy matching module; and total processing time in milliseconds. The operation log does not contain plaintext of sensitive user information before masking, nor does it contain the masked data content after masking; it only records technical information such as the masking strategy identifier and processing time. This log design ensures that the log data itself will not become a channel for the leakage of sensitive user information. The operation log is stored in separate tables by date, with a default retention period of 3 years. Log data exceeding the retention period is automatically archived or securely deleted by the system.

[0066] The following example illustrates the system's operation using a specific order processing flow: This example involves a scenario on a company's e-commerce platform where a user simultaneously purchases a refrigerator and a set of blood glucose test strips. The refrigerator's SKU code is BX001, and the blood glucose test strips' SKU code is XT002. The order submitted by the user lists the recipient's name as Zhang San, their mobile phone number as 13812345678, and their delivery address as a location in Shenzhen, Guangdong Province.

[0067] After the order system generates an order record, it sends a de-identification request to this de-identification processing system. The order data acquisition module receives the request and parses out the order number, the list of product SKU codes, and the user sensitive information fields. The category mapping module queries the category mapping relationship for SKU codes BX001 and XT002 respectively, obtaining the category tag identifier major_appliance for BX001 and the category tag identifier medical_test for XT002. Since this order contains products from two different categories, the category mapping module passes both category tags to the policy matching module.

[0068] The strategy matching module retrieves privacy risk knowledge base results using `major_appliance` and `medical_test` as query keys. The results are as follows: `major_appliance` corresponds to a high risk level, with a home address exposure risk score of 8, a spending power exposure score of 7, and a health privacy relevance score of 0; `medical_test` corresponds to an extremely high risk level, with a health privacy relevance score of 10, a home address exposure risk score of 5, and a spending power exposure score of 3. The strategy matching module applies the highest-risk principle, classifying the entire order as extremely high risk and taking the highest score across all dimensions: a health privacy relevance score of 10, a home address exposure risk score of 8, and a spending power exposure score of 7. Using the extremely high risk level and a health privacy relevance score of 10 as criteria, the module matches the target de-identification strategy from the de-identification strategy set, resulting in the strategy combination with the highest protection strength.

[0069] The data masking module processes sensitive user information according to the target masking strategy. The delivery address field is encrypted and a time-sensitive access token is generated. The token's validity period is set to 24 hours after the estimated delivery receipt, with a maximum of 3 access attempts. During delivery, the logistics system obtains the complete address by submitting a token verification request for delivery operations, and each access is recorded. The recipient's mobile phone number is also encrypted and a time-sensitive token is generated, with the same parameters as the address field. The recipient's name, Zhang San, is masked as Mr. Zhang. The masked order data is returned to the order system, which writes the masked data to its database and then distributes it to the logistics system.

[0070] After the order delivery and receipt event is triggered, the timeliness control submodule's scheduled task begins timing. 24 hours later, the scheduled task detects that both tokens have expired, automatically updates the token status to invalid, and notifies the data masking module to switch the address and phone number fields from reversible masking to irreversible masking. Thereafter, the order's delivery address and phone number are displayed as masked characters in any business system, preventing even internal administrators from accessing the plaintext information.

[0071] For another order containing only daily necessities, the category mapping module identified the category tag as "daily_necessity," the policy matching module determined the risk level to be low from the privacy risk knowledge base, and the matched target anonymization strategy was a standard strength combination. Mobile phone numbers were anonymized with the first three and last four digits visible, while the middle four digits were masked. Addresses were anonymized with the province, city, and district visible, while the detailed house number was masked. Names were displayed in full. The anonymized data met the basic business needs of printing express delivery labels and enabling delivery personnel to contact recipients, while providing a basic level of protection for user information.

[0072] When a user logs into a company's e-commerce platform to view their historical orders, the user center system sends batch order query requests to this de-identification processing system. The system reads the category tags associated with each order and the stored de-identification strategy records, applies the corresponding de-identification strategy, and returns the de-identified data. On the same page, users can see different display methods for personal information in different orders. For example, the mobile phone number for medical device orders is displayed as 138****5678, and the mobile phone number for daily necessities orders is also displayed as 138****5678, but the encryption strength and token mechanism behind the de-identification strategy differ. For large appliances, orders that have been delivered for more than 48 hours show the address as Shenzhen, Guangdong Province. This differentiated display is completed automatically by the system; users do not need to know the underlying category risk perception and strategy matching logic.

[0073] When customer service personnel handle after-sales inquiries, the customer service system sends an order query request to this anonymized processing system. After identifying the request source as the customer service system, the system returns anonymized data with appropriate granularity, based on the order's category tag and the customer service personnel's authorization level. For after-sales inquiries related to Class I medical devices, the system applies additional protection to sensitive health-related information: only the first three digits of the phone number are displayed, and the address is displayed only up to the district / county level. Access to complete contact information requires security audit approval and is recorded throughout the process. For after-sales inquiries related to daily necessities, customer service personnel can see the contact information behind a standard mask to efficiently handle returns and exchanges. All sensitive information access behaviors of customer service personnel are recorded in the operation log. If frequent abnormal access behavior occurs to orders of a certain category, the system can use security audit tools to perform alert analysis.

[0074] When operations personnel perform data analysis, the data analysis system sends batch data query requests to this data anonymization system. After identifying the data analysis attributes of the requests, the system performs high-intensity anonymization on all returned data. Addresses are anonymized to the province level, mobile phone numbers are fully masked, and names are replaced with anonymous identifiers. Operations personnel can only view aggregated statistical data and cannot trace individual user information, ensuring user privacy is not compromised while data analysis operations can proceed smoothly.

[0075] The above implementation details the module structure, data flow, and processing flow of the user information anonymization system for this e-commerce platform. The system incorporates product category characteristics into the anonymization strategy decision-making process through a category mapping module and a privacy risk knowledge base, enabling the anonymization system to perceive differences in privacy protection needs across different product categories. The strategy matching module automatically matches anonymization strategies based on privacy risk levels and scores across various dimensions, achieving adaptive adjustment of the anonymization intensity. The timeliness control submodule, through the generation, verification, and automatic expiration mechanism of timeliness access tokens, achieves a smooth transition from information availability during delivery to permanent protection after delivery.

[0076] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A user information anonymization processing system for e-commerce platforms, characterized in that, The system consists of: The order data acquisition module is used to acquire order data generated by the e-commerce platform. The order data includes product SKU codes and user sensitive information fields. The category mapping module stores the mapping relationship between product SKU codes and product category tags, and is used to determine the product category tags associated with an order based on the product SKU code; The privacy risk knowledge base stores the privacy risk levels corresponding to various product category tags. The strategy matching module is used to obtain the corresponding privacy risk level from the privacy risk knowledge base based on the product category tags associated with the order, and determine the target de-identification strategy from the preset de-identification strategy set based on the privacy risk level. The desensitization module is used to perform desensitization processing on the user sensitive information fields using the target desensitization strategy.

2. The user information de-identification processing system for an e-commerce platform according to claim 1, characterized in that, The privacy risk knowledge base also stores scores for multiple privacy risk dimensions corresponding to each product category tag. These multiple privacy risk dimensions include at least two of the following: health privacy relevance, home address exposure risk, social relationship exposure, spending power exposure, behavioral preference exposure, minor protection relevance, and occupational relevance. The privacy risk level is determined based on a comprehensive score of multiple privacy risk dimensions.

3. The user information desensitization system for e-commerce platforms according to claim 1, characterized in that, When an order contains multiple different product SKU codes, the category mapping module is used to obtain the product category tag corresponding to each product SKU code. The strategy matching module is used to obtain the privacy risk level and the score of each privacy risk dimension corresponding to each product category tag from the privacy risk knowledge base, and determine the highest privacy risk level as the overall privacy risk level of the order, and determine the highest value of the score of each privacy risk dimension as the overall score of the order in that dimension. The target de-identification strategy is determined based on the overall privacy risk level and the overall score.

4. The user information desensitization system for e-commerce platforms according to claim 1, characterized in that, The strategy matching module is specifically used for: Obtain the privacy risk level and scores for each privacy risk dimension corresponding to the product category tags associated with the order in the privacy risk knowledge base; Iterate through each candidate desensitization strategy in the set of desensitization strategies. Each candidate desensitization strategy is pre-configured with risk level triggering conditions and dimension score triggering thresholds. Candidate desensitization strategies that meet the triggering conditions are identified as target desensitization strategies; When multiple candidate desensitization strategies meet the triggering conditions simultaneously, the target desensitization strategy is selected according to a preset priority rule. The preset priority rule is that health privacy relevance takes precedence over social relationship exposure, social relationship exposure takes precedence over home address exposure risk, and home address exposure risk takes precedence over spending power exposure.

5. The user information desensitization system for e-commerce platforms according to claim 1, characterized in that, The set of desensitization strategies includes a time-sensitive control desensitization strategy. The time-sensitive control desensitization strategy sets a first desensitization granularity and a second desensitization granularity for the address field in the user sensitive information field, and configures time-sensitive switching conditions. The desensitization processing module is used to desensitize the address field using the first desensitization granularity when the timeliness switching condition is not met, and automatically switches to desensitizing the address field using the second desensitization granularity after the timeliness switching condition is met. The information exposure degree of the second desensitization granularity is lower than that of the first desensitization granularity.

6. The user information de-identification processing system for an e-commerce platform according to claim 1, characterized in that, The desensitization processing module is also used to generate a time-limited access token associated with the user sensitive information field. The time-limited access token includes a token validity period and a maximum number of accesses. When the token is within its validity period and the current number of accesses has not reached the maximum number of accesses, the desensitization processing module decrypts and returns the original user sensitive information field before desensitization according to the received token verification request. When the token expires or the current number of accesses reaches the maximum number of accesses, the time-sensitive access token becomes invalid, and the de-identification module prohibits decryption operations.

7. The user information desensitization system for e-commerce platforms according to claim 1, characterized in that, The de-identification strategy set includes at least two of the following field-level de-identification strategy templates: Address field masking strategy templates should include at least five granularity levels: full plaintext display, province / city / district visible with detailed address mask, province / city only visible, province only visible, and full mask. The mobile phone number field desensitization strategy template includes at least four granularity levels: the first three and last four digits are visible and the middle is masked; only the first three digits are visible and the rest are masked; full mask and the token is reversible; and full mask is irreversible. Name field anonymization strategy template should include at least four granularity levels: full name display, surname plus title mask, surname only display, and full mask. The target de-identification strategy is generated by combining at least one field-level de-identification strategy template.

8. The user information desensitization processing system for an e-commerce platform according to claim 5, characterized in that, The time-sensitive switching condition includes a preset time length after the order delivery and receipt event is triggered. Different product category tags correspond to different preset time lengths, which shorten as the privacy risk level of the corresponding product category tag in the privacy risk knowledge base increases.

9. The user information desensitization processing system for an e-commerce platform according to claim 1, characterized in that, The system also includes an operation log recording module, which records the operation log for each de-identification process. The operation log includes the request timestamp, the system identifier of the request source, the order number, the identified product category tag, the obtained privacy risk level, the determined target de-identification strategy identifier, and the de-identification processing time. The operation log does not contain the plaintext of user sensitive information fields before the de-identification process.

10. The user information desensitization processing system for an e-commerce platform according to claim 1, characterized in that, The privacy risk knowledge base has a dynamic update interface, which is used to receive and store new product category tags and their corresponding privacy risk levels and scores of multiple privacy risk dimensions, or modify the privacy risk levels and scores of multiple privacy risk dimensions of existing product category tags. The updated privacy risk knowledge base takes effect immediately in the subsequent anonymization processing of order data.

Images