Data hierarchical desensitization method and device

Abstract

The application provides a data hierarchical desensitization method and device. The method comprises the following steps: obtaining a queried target data object in response to an access request for a target service; calculating a real-time risk value of the current access according to a service use attribute vector of the target service; determining a comprehensive data security level corresponding to the target data object; determining a field sensitive weight corresponding to each field in the target data object according to a corresponding field sensitive level, a field identity quantization value, a field correlation quantization value and a regulatory sensitivity quantization value; determining a business minimum available demand factor corresponding to the field; determining a desensitization strength corresponding to the field according to the real-time risk value, the comprehensive data security level, the field sensitive weight and the business minimum available demand factor; and performing desensitization processing on each field in the queried target data object according to the desensitization strength corresponding to each field. The method can improve the desensitization accuracy.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data classification and desensitization method and apparatus. Background Technology

[0002] In database security governance, sensitive fields in the query results are anonymized before being returned. This can be done by methods such as partial hiding, replacement, hashing, tokenization, or reduced precision to avoid direct exposure of sensitive information.

[0003] Traditional methods support column-level data masking, enabling real-time protection without altering the original data in the production database. However, traditional methods offer coarse-grained masking, typically requiring the selection of a fixed mask template for data retrieved by access requests, which can lead to inaccurate masking.

[0004] Therefore, how to improve the accuracy of desensitization is a problem worth studying. Summary of the Invention

[0005] To address the aforementioned technical problems, this application provides a data hierarchical desensitization method, apparatus, computer program product, computer equipment, and computer-readable storage medium.

[0006] Firstly, this application provides a data hierarchical desensitization method, including: In response to an access request targeting a specific business function, the target data object is obtained. Calculate the real-time risk value of this visit based on the business purpose attribute vector of the target business; Determine the comprehensive data security level corresponding to the target data object; For each field in the target data object, determine the field sensitivity weight based on the field sensitivity level, field identifier quantification value, field correlation quantification value, and regulatory sensitivity quantification value. Determine the minimum available business requirement factor corresponding to the field; the minimum available business requirement factor is used to characterize the degree of requirement of the target business for the effective information in the field; The desensitization strength of a field is determined based on the real-time risk value, the overall data security level, the field sensitivity weight, and the minimum availability requirement factor for the business. Based on the desensitization strength corresponding to each field, desensitization processing is performed on each field in the queried target data object.

[0007] In one embodiment, determining the minimum available business requirement factor corresponding to the field includes: Determine the degree of dependency of the access subject's role on the field to obtain the role dependency. Determine the degree of dependence of the target business task on the field to obtain the task dependency. Determine the necessity of fields when performing business functions in the business process to obtain the field function dependency; Determine the level of information that a field is allowed to retain after approval to obtain the approval exemption level; Based on role dependency, task dependency, field function dependency, and approval exemption, the minimum available business requirement factor corresponding to the field is obtained.

[0008] In one embodiment, the real-time risk value of this access is calculated based on the business purpose attribute vector of the target service, including: Determine the access subject attribute vector and the environment context attribute vector for this access; The real-time risk value for this visit is calculated based on the business purpose attribute vector, the access subject attribute vector, and the environment context attribute vector.

[0009] In one embodiment, the real-time risk value of this access is calculated based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector, including: Determine the business purpose credibility factor based on the business purpose attribute vector; Determine the trust level of the accessing subject based on the accessing subject's attribute vector; Environmental risk factors are determined based on environmental context attribute vectors; The real-time risk value for this visit is determined based on the trust factor of the business purpose, the trust level of the accessing entity, and the environmental risk factor.

[0010] In one embodiment, the real-time risk value of this access is calculated based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector, including: The first interaction vector is obtained by combining the access subject attribute vector and the environment context attribute vector element by element. The second interaction vector is obtained by combining the access subject attribute vector and the business purpose attribute vector element by element; The real-time risk value for this visit is calculated based on the business purpose attribute vector, the access subject attribute vector, the environment context attribute vector, the first interaction vector, and the second interaction vector.

[0011] In one embodiment, the method further includes: Determine the risk of purpose offset between the requested purpose and the permitted purpose of the access request; Determine the context anomaly correction item; wherein, the context anomaly correction item is used to characterize the anomaly information in this access that is used to correct the real-time risk value; The time window risk is determined by the distance between the access time of this visit and the preset business time center. Based on the number of abnormal behaviors of the accessing entity within a preset time period, the historical abnormal behavior risk is obtained; The calculated real-time risk value is corrected based on the risk of application deviation, context anomaly correction item, time window risk, and historical behavior anomaly risk. Based on real-time risk values, comprehensive data security levels, field sensitivity weights, and minimum business availability factors, the de-identification strength for each field is determined, including: The desensitization intensity of each field is determined based on the revised real-time risk value, comprehensive data security level, field sensitivity weight, and minimum business availability factor.

[0012] In one embodiment, the de-identification strength of a field is determined based on the real-time risk value, the overall data security level, the field sensitivity weight, and the minimum availability factor for the business, including: Determine the first coupling enhancement term between the comprehensive data security level and the real-time risk value; Determine the second coupling enhancement term between field sensitivity weights and real-time risk values; The nonlinear enhancement term for the high-risk range is determined based on the real-time risk value; The desensitization intensity of a field is determined based on real-time risk value, comprehensive data security level, field sensitivity weight, minimum available business requirement factor, first coupling enhancement term, second coupling enhancement term, and nonlinear enhancement term in high-risk interval.

[0013] In one embodiment, the target data object includes an identifier field; based on the desensitization strength corresponding to each field, desensitization processing is performed on each field in the queried target data object, including: The mixing coefficient is determined based on the desensitization strength corresponding to the identifier field; the mixing coefficient is positively correlated with the desensitization strength. The identifier field is de-identified using a masking function to obtain the masked result; The identifier field is de-identified using the tokenization function to obtain the tokenized result; The masking result and the tokenization result are mixed according to the mixing coefficient to obtain the de-identification result corresponding to the identifier field.

[0014] In one embodiment, before performing desensitization processing on each field in the queried target data object according to the desensitization strength corresponding to each field, the method further includes: Obtain the coefficient of basic information content of the field; For each field in the target data object, the available information of the field at the corresponding desensitization strength and the basic information content coefficient of the field is generated; the available information content is used to measure the effective information retained by the field at the corresponding desensitization strength. If the amount of available information does not meet the constraints on available information, adjust the desensitization strength of the corresponding field. When the amount of available information of a field under the adjusted desensitization strength meets the available information constraint, desensitization processing is performed on each field in the queried target data object according to the desensitization strength corresponding to each field.

[0015] Secondly, a data hierarchical desensitization device is provided, comprising: The data acquisition module is used to respond to access requests for the target business and obtain the target data object to be queried; The real-time risk assessment module is used to calculate the real-time risk value of this access based on the business purpose attribute vector of the target business. The desensitization intensity determination module is used to determine the comprehensive data security level corresponding to the target data object; for each field in the target data object, it determines the field sensitivity weight corresponding to the field based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value; it determines the minimum available business demand factor corresponding to the field; the minimum available business demand factor is used to characterize the degree of demand of the target business for the effective information in the field; and it determines the desensitization intensity corresponding to the field based on the real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business demand factor. The desensitization module is used to desensitize each field in the queried target data object according to the desensitization strength corresponding to each field.

[0016] Thirdly, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described data hierarchical desensitization method.

[0017] Fourthly, a computer device is provided, including a processor and a memory connected to the processor. The memory stores a computer program that can be executed by the processor. When the computer program is executed by the processor, it implements the steps of the above-described data hierarchical desensitization method.

[0018] Fifthly, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the above-described data hierarchical desensitization method.

[0019] The aforementioned data classification and anonymization methods, devices, computer program products, computer equipment, and computer-readable storage media, in response to an access request for a target business, obtain the target data object to be queried; calculate the real-time risk value of this access based on the business purpose attribute vector of the target business; determine the comprehensive data security level corresponding to the target data object; for each field in the target data object, determine the field sensitivity weight corresponding to the field based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value corresponding to the field; determine the minimum available business demand factor corresponding to the field; the minimum available business demand factor is used to characterize the degree of demand of the target business for the effective information in the field; determine the anonymization intensity corresponding to the field based on the real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business demand factor; and perform anonymization processing on each field in the queried target data object according to the anonymization intensity corresponding to each field. In other words, the real-time risk value of this access is calculated more accurately based on the business purpose attribute vector, and the field sensitivity weight is determined based on the field sensitivity level, field identifiability quantification value, field relevance quantification value, and regulatory sensitivity quantification value. This field sensitivity weight represents the comprehensive sensitivity of the field in dimensions such as identifiability, relevance, business sensitivity, and regulatory sensitivity. Furthermore, the real-time risk value of this access, the comprehensive data confidentiality level, the field sensitivity weight, and the minimum available business requirement factor—these multi-dimensional information accurately and dynamically determine the fine-grained field-level de-identification intensity. This dynamic field-level de-identification intensity improves the accuracy of de-identification. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a data hierarchical desensitization method in one embodiment; Figure 2 This is a flowchart illustrating the risk value correction step in one embodiment; Figure 3 This is a structural block diagram of a data hierarchical desensitization device in one embodiment; Figure 4 This is a structural block diagram of the data hierarchical desensitization device in another embodiment; Figure 5 This is a schematic diagram of the internal structure of a computer device in one embodiment. Detailed Implementation

[0021] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In the following description, the phrase "some embodiments" refers to a subset of all possible embodiments. It should be noted that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0024] In the following description, the terms "first," "second," etc., are used only for distinction and not for limitation in terms of size, quantity, or subordination.

[0025] like Figure 1 As shown, in some embodiments, a data hierarchical desensitization method is provided, applied to a computer device, the method comprising the following steps: S11 responds to the access request for the target business and obtains the queried target data object.

[0026] Specifically, after receiving an access request for the target business, data access query processing can be performed from the database to obtain the target data object.

[0027] S12, calculate the real-time risk value of this visit based on the business purpose attribute vector of the target business.

[0028] The business purpose attribute vector includes objective quantitative indicators of purpose compliance. These objective quantitative indicators are used to quantify the compliance of the purpose (also known as business purpose or request purpose) of the target business targeted by the access request.

[0029] In some embodiments, the business purpose attribute vector b is as follows: ; That is, the business purpose attribute vector b includes the completeness of the work order voucher. Business necessity The degree of matching between purpose and field range Approval adequacy Or access frequency suitability At least one objective quantitative indicator.

[0030] The following metrics are used to determine whether a complete work order credential has been created for the "purpose of the request" (i.e., the purpose of the target business for which the access request is directed). Purpose and field range matching refers to the degree of match between the requested business purpose (or the requested purpose) and the range of the queried fields. Business necessity characterizes the urgency and irreplaceability of the business purpose. Approval sufficiency characterizes whether the requested purpose has undergone sufficient approval. Access frequency suitability characterizes whether the access frequency for the target business to which the business purpose belongs conforms to or matches a preset pattern.

[0031] It should be understood that the real-time risk value of this access can be calculated based solely on the business purpose attribute vector of the target business, or it can be calculated by combining the business purpose attribute vector with attribute vectors from other dimensions. Let the real-time risk score be Γ, with a value range of [0,1], which is used to represent the degree of risk of the current access request relative to the expected security baseline.

[0032] In some embodiments, the access subject attribute vector and the environment context attribute vector for this access are determined; based on the business purpose attribute vector, the access subject attribute vector, and the environment context attribute vector, the real-time risk value for this access is calculated.

[0033] In some examples, the access subject attribute vector u is as follows: ; That is, the access subject attribute vector u includes the credibility of the role to which the access subject belongs. Authentication strength of the access subject Historical compliance scores corresponding to the accessing entity Device binding degree and the completeness of the certificate Among them, certification strength This represents the degree of authentication of the access rights of the accessing subject; historical compliance score. This refers to a compliance score based on the access subject's historical access behavior; device binding degree. This refers to the degree of binding between the accessing entity and the device used; certificate completeness. This refers to the completeness of the authentication certificate issued to the accessing entity (used to characterize the validity of the certificate).

[0034] In some examples, the environment context attribute vector e is as follows: ; That is, the environmental context attribute vector e includes the degree of geographical location deviation. Access time risk Network environment risks Endpoint security status risk Agency risk Among them, the degree of geographical location deviation refers to the degree of deviation between the physical location of this visit and the user's (i.e., the access subject's) historical regular location; proxy risk refers to the risk of the proxy nodes traversed during this visit.

[0035] S13, determine the comprehensive data security level corresponding to the target data object.

[0036] The comprehensive data security level corresponding to the target data object being queried is denoted as . Its value is located in the interval ,in: Indicates non-sensitive or public level; This indicates the highest level of sensitivity.

[0037] S14. For each field in the target data object, determine the field sensitivity weight based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value.

[0038] It should be understood that field sensitivity weights are used to represent the comprehensive sensitivity of a field across dimensions such as identifiability, associativity, business sensitivity, and regulatory sensitivity. Therefore, the field sensitivity weight is determined based on the field's sensitivity level, quantified value of field identifiability, quantified value of field associativity, and quantified value of regulatory sensitivity. Specifically, the quantified value of field identifiability characterizes the field's identifiability (i.e., measures the degree to which the field can uniquely identify or identify a corresponding object). The quantified value of field associativity characterizes the field's associativity (i.e., measures the associativity of the current field with other fields). The quantified value of regulatory sensitivity characterizes the field's regulatory sensitivity (i.e., measures the degree of legality / compliance of regulatory requirements on the field).

[0039] For the Each field (i.e., field) i Define the field sensitivity weight as ,satisfy: ; i It can be any positive integer.

[0040] In some embodiments, the first may be set The field sensitivity level of each field is [value]. The total number of its discrete levels is Then, continuous normalization can be performed first using the following formula: ; Therefore, the first can be calculated using the following formula. Field sensitivity weights for each field : ; in, For the first The normalized sensitivity level of each field. Indicates the first The quantified value of the field identifier for each field. Indicates the first The quantified value of the field correlation of each field. Indicates the first The regulatory sensitivity quantification value of each field; to These are the weighting coefficients for different weighting terms; clip() is the truncation function used to control... .

[0041] S15, determine the minimum available business demand factor corresponding to the field; the minimum available business demand factor is used to characterize the degree of demand of the target business for the effective information in the field.

[0042] It should be understood that the first The minimum available demand factor for each field is: , The larger the value, the more important the target business is to the first... The higher the demand for valid information in each field (i.e., the more necessary it is to retain the first field), the greater the need to retain the first field. (Valid information in each field).

[0043] In some embodiments, the minimum available demand factor It can be a preset experience value, or it can be based on character dependency. Task dependency Field functionality dependency and approval exemption The specific calculation formula is as follows, obtained through joint calculation: ; in, Indicates the role of the accessing subject in the field. The degree of dependence, This indicates the field representing the task corresponding to the target business (i.e., the current business task). The degree of dependence, This indicates the field used when performing business functions within a business process. The necessity of Representation field The minimum information strength that can be retained after approval; to This refers to the weighting coefficient.

[0044] S16. Determine the desensitization strength of the field based on the real-time risk value, comprehensive data confidentiality level, field sensitivity weight, and minimum availability requirement factor for the business.

[0045] No. The desensitization strength of each field is denoted as . ( ); The larger the value, the stronger the desensitization effect. The less information is retained; A smaller value indicates a weaker desensitization intensity and more information retained. It should be understood that desensitization intensity... The domain is a continuous interval [0,1], which can be continuously adjusted within the interval [0,1].

[0046] For example, the desensitization intensity can be calculated using the following formula: ; in, It is the first The desensitization strength of each field, It is a comprehensive data security level. It is the first Field sensitivity weights for each field. It is a real-time risk score. It is the first The minimum available business requirements for each field are as follows: For bias terms, to These are non-negative weighting coefficients. It is a truncation function used to control... .

[0047] In some embodiments, step S16 includes: determining a first coupling enhancement term between the comprehensive data security level and the real-time risk value; determining a second coupling enhancement term between the field sensitivity weight and the real-time risk value; determining a nonlinear enhancement term for the high-risk interval based on the real-time risk value; and determining the desensitization intensity corresponding to the field based on the real-time risk value, the comprehensive data security level, the field sensitivity weight, the minimum available business requirement factor, the first coupling enhancement term, the second coupling enhancement term, and the nonlinear enhancement term for the high-risk interval.

[0048] For example, the first can be calculated according to the following formula. Desensitization strength of each field : in, This refers to the comprehensive data security level. With real-time risk value The first coupling enhancement term, This refers to field-sensitive weights. With real-time risk value The second coupling enhancement term, This refers to the non-linear enhancement term in the high-risk region, and max() is the function that takes the maximum value. It is a preset risk threshold.

[0049] It should be understood that, for In other words, if the real-time risk value Less than the risk threshold If the real-time risk value is 0, then the maximum value is 0. Greater than the risk threshold The maximum value is positive, therefore, it indicates that only when the risk threshold is exceeded... In the high-risk range, an enhancement will be applied, meaning there is a non-linear enhancement term. If the risk exceeds a certain threshold, the penalty will increase quadratically (parabolically) with the increase in the amount exceeding the threshold; if the risk threshold is not exceeded... The latter are completely negligible.

[0050] It should be understood that considering the first coupling enhancement term, the second coupling enhancement term, and the nonlinear enhancement term in the high-risk interval when calculating the desensitization strength can not only reflect the linear contribution of the input factors, but also the accelerated desensitization characteristics above the high-risk threshold, and more fully reflect the characteristic that "high-density fields need to be desensitized faster in high-risk scenarios", thereby improving the accuracy of the desensitization strength.

[0051] In some embodiments, to avoid drastic fluctuations in the masking strength between adjacent requests, when calculating the masking strength for a certain field, the instantaneous masking strength calculated in real time based on the real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business requirement factor is used as the initial masking strength. The initial masking strength calculated for that field in the current access is then smoothed using the masking strength corresponding to that field in the previous access (i.e., a time smoothing term is introduced) to obtain the final masking strength corresponding to that field in the current access. It should be understood that the specific processing of the instantaneous masking strength calculated in real time based on the real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business requirement factor is described above and will not be repeated here.

[0052] For example, the specific formula for the desensitization intensity smoothing constraint is as follows: ; in, It is the th visit in the current time t (i.e., this visit). i The final desensitization strength corresponding to each field For the current time t (i.e., this visit), the number of visits calculated in real time is the first. i The desensitization strength of each field, The first visit in the previous time step (i.e., the last visit)i The desensitization strength corresponding to each field This is the smoothing coefficient.

[0053] S17. Based on the desensitization strength corresponding to each field, perform desensitization processing on each field in the queried target data object.

[0054] In some embodiments, to achieve a balance between data masking security and business availability, available information constraints are introduced. Before performing field-level data masking in step S17, the amount of available information for each field at its corresponding masking strength is controlled to meet the available information constraints. Field-level data masking is then performed in step S17 only after the available information constraints are met. Subsequently, the masked data (i.e., the masked data itself) is returned to the query client, which can then display the masked data on its interface.

[0055] Specifically, before step S17, the basic information content coefficient of the field is obtained; for each field in the target data object, the available information content of the field under the corresponding desensitization intensity is generated according to the desensitization intensity of the field and the basic information content coefficient of the field; the available information content is used to measure the effective information retained by the field under the corresponding desensitization intensity; if the available information content does not meet the available information constraint, the desensitization intensity of the field is adjusted; when the available information content of the field under the adjusted desensitization intensity meets the available information constraint, step S17 is executed.

[0056] In some embodiments, the first Each field has a high degree of desensitization. Available information below The calculation formula is: ;in, For the first The coefficient of basic information content of each field.

[0057] In some embodiments, the available information constraint includes that the amount of available information for a field under the desensitization strength is greater than or equal to the minimum available information amount. For example, a uniform minimum available information amount (i.e., available information amount threshold) can be set for all fields, or the corresponding minimum available information amount can be calculated based on the characteristics of each field.

[0058] In some examples, available information constraints include: ;in, This represents the minimum amount of usable information. When the amount of usable information... Less than When this condition is not met, the available information constraint is not satisfied, and therefore the first condition can be adjusted. The desensitization strength corresponding to each field , so that: This is equivalent to making the first The adjusted desensitization intensity of each field Available information below (That is, satisfying the available information constraint). These are preset adjustment parameters. In this embodiment, adaptive desensitization under the constraint of minimum available information is implemented. By constraining the amount of available information, the minimum amount of available information required for the business can be avoided due to excessive desensitization, thus ensuring the effectiveness of the query.

[0059] For example, let a certain field i Field basic information coefficient Business requirements for minimum usable information If the desensitization intensity is directly calculated based on parameters such as real-time risk values... Then the field i In desensitization intensity Available information below This means that the available information constraint is not met, therefore the system automatically adjusts the desensitization strength to: This avoids the business becoming completely unavailable due to high-risk scoring.

[0060] In some examples, the basic information content coefficient of the field The calculation formula is: in, For the first The normalized information entropy corresponding to each field Indicates the first The contribution of each field to the current business task (i.e., the task corresponding to the target business). Indicates the first The ability of each field to be associated with other fields. Indicates the first Each field corresponds to a regulatory requirement amendment item. to These are the weighting coefficients for different weighting terms.

[0061] In some examples, the first Minimum amount of usable information corresponding to each field The calculation formula is: in, Indicates the first The hard rule constraints corresponding to each field Indicates the first The minimum available demand factor corresponding to each field Indicates the first The contribution of each field to the current business task; to These are the weighting coefficients for different weighting terms; hard rule constraint terms refer to the constraint strength of hard constraint rules applied to the field.

[0062] In this example, the minimum amount of information available for each field can be determined more accurately, thereby enabling more precise constraints on the adjustment of the desensitization intensity and improving the accuracy of desensitization.

[0063] In some embodiments, when the available information constraint is not met, the desensitization intensity is adjusted to a more precise level through feasible region projection. Let the candidate intensity directly generated by the risk model be... The final desensitization intensity will be determined by... (That is, the adjusted desensitization intensity) can be calculated using the following formula: And satisfy the following constraints: Where m is a variable with a value range of [0,1], the purpose of equation (1) is to find a value within the interval [0,1] that is consistent with... The nearest m is taken as Furthermore, the obtained m needs to satisfy the constraints shown in equations (2) to (4) above. Indicates the maximum allowable desensitization strength for the field type. This indicates the upper limit of the allowable variation in desensitization intensity between adjacent requests. The first visit in the previous time step (i.e., the last visit) i The masking strength corresponds to each field. In this embodiment, when adjusting the masking strength, the upper limit of field types and output stability can be considered while meeting the minimum availability requirements of the business, thereby enabling a more accurate determination of the masking strength.

[0064] In some embodiments, for the target data object The total continuous desensitization intensity vector is defined by the following fields: .

[0065] To facilitate auditing, policy governance, and interface display, the system can also provide a graded interpretation function for the continuous de-identification intensity: ; in, This indicates the interpretation level or execution level label, and the desensitization strength of the i-th field. It maintains a continuous value. That is, based on the continuous desensitization intensity. Generate corresponding hierarchical explanation tags This tiered label will be used for audit logs, interface displays, or policy playback.

[0066] In some embodiments, the de-identification result can be output (e.g., returned to the query end), and the risk score, comprehensive data security level, de-identification strength vector, parameter snapshot, and hit rule can be recorded. When scenario-related information (e.g., real-time risk, environmental context, etc.) changes, the de-identification strength of each field can be dynamically updated, and the de-identification result can be regenerated.

[0067] In the above method, the real-time risk value of this access is calculated more accurately based on the business purpose attribute vector. Furthermore, the field sensitivity weight is determined based on the field sensitivity level, field identifiability quantification value, field relevance quantification value, and regulatory sensitivity quantification value. This field sensitivity weight represents the comprehensive sensitivity of the field across dimensions such as identifiability, relevance, business sensitivity, and regulatory sensitivity. Furthermore, the multi-dimensional information, including the real-time risk value of this access, the comprehensive data confidentiality level, the field sensitivity weight, and the minimum available business requirement factor, accurately and dynamically determines the fine-grained field-level de-identification intensity. This dynamic field-level de-identification intensity improves the accuracy of de-identification.

[0068] Some solutions employ role-based dynamic desensitization techniques, applying different functions and parameters to the same field based on different roles, thus addressing the issue of "different identities seeing different results." However, the core of these solutions remains a pre-defined rule table and role mapping, resulting in outputs that are typically discrete levels. This means they use discrete rule mapping to select or map a single desensitization rule, which is not accurate enough. Some solutions use priority-based selection techniques, choosing a winning desensitization strategy when multiple candidate strategies conflict. Essentially, these solutions still select an application from a finite number of rule templates, also falling under static discrete decision-making. Some solutions use rule combination desensitization techniques to support custom desensitization functions, combinations of public and private rules, and preservation of cross-system cross-references. However, their desensitization schemes are still primarily configured manually beforehand, essentially remaining a static discrete rule selection strategy.

[0069] This solution calculates continuously changing field-level anonymization strength based on factors such as continuous risk, comprehensive data security level, field sensitivity weights, and minimum usability requirements for business. This essentially expands the template from a fixed set of levels to a continuously parameterized output. Compared to using discrete selection rules, it enables the same field to output different anonymization granularities based on dynamically changing anonymization strengths in different scenarios. Subtle changes are mapped to a gradual contraction in the number of display bits, retained segments, and readable granularity, rather than being limited to jumps between a few fixed templates. This improves the precision, adaptability, and practical usability of anonymization. It enhances the precision, flexibility, and interpretability of dynamic anonymization, preserving the minimum effective information required by the business while ensuring security. Furthermore, it reduces rule explosion, improves policy reusability, and enhances policy governance efficiency.

[0070] In some embodiments, the real-time risk value of this access is calculated based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector. The formula is as follows: Equation (5) Among them, the access subject attribute vector is The environment attribute vector is The business purpose attribute vector is , For bias terms, , and These are the access subject attribute vectors. , Environment attribute vector Business Purpose Attribute Vector The corresponding weight vectors.

[0071] also, For the Sigmoid function: Equation (6) That is, the formula (5) can be used to... Substitute x into equation (6) to calculate the real-time risk value for this visit. .

[0072] In some embodiments, a business purpose trust factor is determined based on a business purpose attribute vector; an access subject trust level is determined based on an access subject attribute vector; an environmental risk factor is determined based on an environmental context attribute vector; and a real-time risk value for the current access is determined based on the business purpose trust factor, the access subject trust level, and the environmental risk factor.

[0073] In some embodiments, the access subject trust level A higher value indicates a higher level of trustworthiness of the accessing entity. Access Entity Trustworthiness Level The calculation formula is as follows: That is, the role credibility of the access subject's attribute vector u. Authentication strength of the access subject Historical compliance scores corresponding to the accessing entity Device binding degree and the completeness of the certificate According to the corresponding weighting coefficients to Perform a weighted summation and use the clip() function to truncate the result, thus controlling the trust level of the output access subject. .

[0074] In some embodiments, environmental risk factors A higher value indicates a less trustworthy access environment. Environmental risk factor. The calculation formula is as follows: That is, the degree of geographical location deviation in the environmental context attribute vector e. Access time risk Network environment risks Endpoint security status risk Agency risk According to the corresponding weighting coefficients to Perform a weighted summation and use the clip() function to truncate the result, ensuring that the output environmental risk factor is... .

[0075] In some embodiments, business purpose credibility factor A higher value indicates a more reasonable and explainable business purpose (i.e., the intended use of the target business). Business Purpose Credibility Factor The calculation formula is as follows: That is, the work order voucher completeness in the business purpose attribute vector b. Business necessity The degree of matching between purpose and field range Approval adequacy Or access frequency suitability According to the corresponding weighting coefficients to Perform a weighted summation and use the clip() function to truncate the result, thus ensuring the reliability of the output for business applications. .

[0076] In some embodiments, the time window risk is determined based on the distance between the access time of this visit and the preset business time center. For example, the calculation formula is: ; in, This indicates the time window risk at the current access time t (i.e., the current moment). This indicates the distance that the access time t deviates from the preset business time center. The allowed window size.

[0077] Furthermore, based on the number of abnormal behaviors exhibited by the accessing entity within a preset time period, historical abnormal behavior risk is calculated. For example, the calculation formula is: Historical Abnormal Behavior Risk ;in, N represents the number of abnormal behaviors of the accessing entity within a preset time period, where N is the total count of behaviors of the accessing entity within the preset time period. This is a smoothing term.

[0078] In some embodiments, the real-time risk value of this access is determined based on the trust factor of business purpose, the trust level of the accessing subject, the environmental risk factor, the time window risk, and the risk of abnormal historical behavior.

[0079] For example, the real-time risk value of this visit The calculation formula is as follows: ; in, Indicates the trust level of the accessing entity. Indicates environmental risk factors, Indicates the credibility factor for business application. Indicates time window risk, Indicates a risk of abnormal historical behavior; to These are the weighting coefficients for different weighting terms.

[0080] The above solution unifies the modeling of data security level, field sensitivity weight (i.e., field sensitivity), access subject trust level, environmental risk, business purpose and minimum availability requirements, and generates continuously changing desensitization intensity, thereby achieving refined hierarchical output of the same field in different scenarios.

[0081] In some embodiments, such as Figure 2 As shown, a risk value correction procedure is provided, which specifically includes the following steps: S21, determine the risk of purpose offset between the requested purpose and the permitted purpose corresponding to the access request.

[0082] The purpose of the request refers to the specific business purpose for which this access request targets the desired service. In other words, it indicates which business purpose the data accessed in this request is intended to be used for.

[0083] Permitted use refers to the purpose for which access is permitted due to security access control regulations.

[0084] In some examples, there is a risk of usage offset. The calculation formula is as follows: Right now, Indicate the purpose of the request With Permitted Use Risk of deviation between the two.

[0085] S22, determine the context anomaly correction item; wherein, the context anomaly correction item is used to characterize the anomaly information in this access that is used to correct the real-time risk value.

[0086] In some examples, the context anomaly correction item is obtained by jointly correcting for geographic location mutations, proxy chain changes, access speed anomalies, and device switching anomalies. Specifically, geographic location mutations characterize changes in the physical location (i.e., IP address) of the current access compared to historical access locations, indicating IP anomalies. Proxy chain changes characterize changes in the proxy nodes along the proxy chain traversed from the client to the server during this access. Access speed anomalies characterize abnormal changes in the access speed of this access. Device switching anomalies characterize abnormal changes in the device logged in by the accessing subject during this access.

[0087] For example, the formula for calculating the context anomaly correction term is as follows: in, Indicates a sudden change in geographical location, Indicates changes in the proxy chain, This indicates abnormal access speed and This indicates a device switching error; to These are the weighting coefficients for different weighting terms.

[0088] S23. Based on the distance between the access time of this visit and the preset business time center, the time window risk is obtained.

[0089] S24. Based on the number of abnormal behaviors of the accessing subject within a preset time period, obtain the historical abnormal behavior risk.

[0090] S25, based on the application offset risk, context anomaly correction item, time window risk, and historical behavior anomaly risk, correct the calculated real-time risk value.

[0091] In some examples, the risk value correction formula is as follows: ; in, This is the corrected real-time risk value. Indicates time window risk, Indicates a risk of historically abnormal behavior. This indicates a risk of the application deviating from the intended use. to This represents the weighting coefficient for different weighting terms.

[0092] In this embodiment, the real-time risk value of the current access is comprehensively determined based on multiple factors, including the trustworthiness factor of the business purpose, the trustworthiness level of the accessing subject, the environmental risk factor, the time window risk, and the risk of historical behavioral anomalies. Furthermore, the real-time risk value is corrected by integrating the risk of purpose deviation, the context anomaly correction item, the time window risk, and the risk of historical behavioral anomalies. Therefore, the de-identification intensity can be determined more accurately based on the corrected real-time risk value.

[0093] Furthermore, the de-identification strength corresponding to a field can be determined based on the corrected real-time risk value, comprehensive data security level, field sensitivity weight, and minimum usability requirement factor for the business. The inventors of this application have discovered that, for data of the same security level, different business scenarios have different requirements for minimum usability information. Traditional methods using fixed mask templates easily lead to inaccurate de-identification, such as over-identification or insufficient protection. In this embodiment, the minimum usability requirement factor for the business is considered when calculating the de-identification strength, enabling a more accurate calculation of the de-identification strength.

[0094] In some embodiments, calculating the real-time risk value of the current access based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector includes: performing element-wise interactive combination of the access subject attribute vector and the environmental context attribute vector to obtain a first interaction vector; performing element-wise interactive combination of the access subject attribute vector and the business purpose attribute vector to obtain a second interaction vector; and calculating the real-time risk value of the current access based on the business purpose attribute vector, the access subject attribute vector, the environmental context attribute vector, the first interaction vector, and the second interaction vector.

[0095] For example, the formula for calculating the real-time risk value of this visit can also be expressed as: in, This indicates grouping by element interaction. Represents the first interaction vector. Represents the second interaction vector. It is the access subject attribute vector. It is an environment context attribute vector. It is a business purpose attribute vector. , , , , Different weighted vectors are used. The first interaction vector can more accurately quantify the risk value in the combined scenario of "low-trust subject and high-risk environment", while the second interaction vector can more accurately quantify the risk value in the combined scenario of "high-privilege subject and low-necessary use". In this way, the risk value in complex access scenarios can be determined more accurately.

[0096] In some embodiments, fields of different field types in the target data object have their own corresponding desensitization functions. After determining the desensitization strength for each field, the desensitization function corresponding to the field type is called to perform desensitization processing on each field in the queried target data object according to the desensitization strength of each field.

[0097] In some embodiments, the desensitization function for string fields is a continuous mask function. String fields i The length is denoted as The number of characters that need to be masked is denoted as Then we can define: That is, for string fields i length With string fields i Corresponding desensitization intensity Round the product down to get the number of characters in the mask. .

[0098] In some examples, if the prefix is ​​preserved before and after and the middle is masked, the prefix preservation length is... Length retention with suffix satisfy: ; In some examples, ;in, For fields i The field retains the percentage parameter.

[0099] In some embodiments, the desensitization function for the mobile phone number field is a continuous display function.

[0100] Specifically, taking an 11-digit mobile phone number field as an example, its mask length is: ; when When the number changes continuously, the phone number can be output in the following continuous range. Different ranges represent different desensitization levels, and different degrees of desensitization processing can be applied to different levels. For example: Displays the first three and last four digits of an 11-digit mobile phone number field; Displays the first three digits and the last two digits of an 11-digit mobile phone number. : Display only the first three digits of the 11-digit phone number field; : Displays only the number segment affiliation label for the 11-digit mobile number field; : Returns the token value or null value corresponding to the mobile number field.

[0101] To facilitate understanding, an example is given below. Suppose the security factor for a customer's mobile phone number field is... Field sensitivity weight is In a certain access session, the trust level of the accessing entity was... Environmental risk factors Business application credibility factor Time window risk Risk of abnormal historical behavior If we take: ; The real-time risk score is then: If the minimum available demand factor for the business is: ; and take , , , , ,but: Therefore: This allows the system to mask 5 digits of an 11-digit phone number field. Furthermore, the system can output a medium-level desensitization result: "the first three digits + the middle five digits masked + the last three digits shrunk to zero or partial digits according to a strategy." In other embodiments, this can be mapped to a template range that "only displays the first three digits," and there are no limitations on this.

[0102] In some embodiments, the desensitization function for numeric fields is a continuous bucketing function.

[0103] Assume the original value of the numeric field is The basic binning particle size is The bin size under continuous strength is defined as follows: in, , k This represents the amplification factor; corresponding to the desensitization output result. for: To make it easier to understand, an example is given below. Assume the original value of the order amount field i is... , If the basic binning particle size is: The desensitization intensity is: And take the magnification factor. ,but: ; The desensitized output will then be: This allows the precise value to be hidden while retaining the monetary level information.

[0104] In some embodiments, the desensitization function for time-type fields is a continuous precision reduction function.

[0105] The original value of the time field is According to the desensitization intensity Select the time precision level: in, to For different intensity thresholds, Time-type field The time accuracy level.

[0106] To facilitate understanding, an example is given below. Assume that the anonymization strength corresponds to a certain access log time field i. If the intensity threshold is set to: ; Then we have: Therefore, the system reduces the time precision to: ; For example, the original value "2026-05-25 15:36:42" can be output as "2026-05".

[0107] In some embodiments, the target data object may include an identifier field, which may include at least one of the following: original ID card number, original bank card number, original device number, original membership number, or original unified account identifier. It should be understood that although identifier fields are typically strings in terms of data type, they differ from general string fields such as names, addresses, and organization names. Identifier fields possess stronger uniqueness, cross-table joinability, and cross-system reproducibility, meaning that in high-risk scenarios, intermediate masks alone are insufficient to block association inferences. Therefore, a continuous substitution function is used for de-identifying identifier fields. The continuous substitution function is a de-identification function formed by a masking function and a tokenization function. The masking function and tokenization function are selected or combined based on the de-identification strength of the identifier field.

[0108] In some embodiments, for the identifier field in the target data object, a corresponding mixing coefficient is determined based on the desensitization strength of the identifier field; the mixing coefficient is positively correlated with the desensitization strength; the identifier field is desensitized according to the masking function to obtain the masking result; the identifier field is desensitized according to the tokenization function to obtain the tokenization result; the masking result and the tokenization result are mixed according to the mixing coefficient to obtain the desensitization result corresponding to the identifier field.

[0109] For example, for the i-th identifier field It can be based on the corresponding desensitization intensity The specific formula for selecting or combining the masking function and the tokenization function is as follows: in, For identifier fields The corresponding mixing coefficient, f mask () is the mask function. f token () is the tokenization function; Indicates based on the mask function f mask () for identifier fields The mask result obtained after desensitization; This indicates that the identifier field is tokenized using the tokenization function ftoken(). The tokenization result obtained after desensitization Represents identifier field The corresponding desensitization results.

[0110] In some embodiments, the mixing coefficient That is, the mixing coefficient With desensitization intensity Monotonically increasing.

[0111] In some embodiments, the identifier field mixing coefficient The calculation formula is: ; in, Represents identifier field The field identifier quantification value, Represents identifier field The field correlation quantification value, For bias terms, to These are the weighting coefficients for different weighting terms.

[0112] In some embodiments, the desensitized output is represented as: in, Represents a combination operator used to determine the combination coefficients. For the mask result and tokenization results Make a selection or combination.

[0113] It should be understood that masking functions emphasize "preserving format readability," while tokenization functions emphasize "severing the direct relationship between the original value and the externally visible value." When the desensitization strength... When the masking strength is low, the masked result can be used first to retain a certain degree of format readability and facilitate manual verification; when the desensitization strength is high... As the tokenization rate increases, the tokenization ratio can be gradually increased to sever the direct link between the original identifier and the externally visible value, thereby further weakening reversibility and connectivity.

[0114] like Figure 3 As shown, in some embodiments, a data hierarchical desensitization device is provided, comprising: The data acquisition module 302 is used to respond to access requests for the target business and obtain the target data object to be queried; The real-time risk determination module 304 is used to calculate the real-time risk value of this access based on the business purpose attribute vector of the target business. The desensitization intensity determination module 306 is used to determine the comprehensive data security level corresponding to the target data object; for each field in the target data object, it determines the field sensitivity weight corresponding to the field based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value; it determines the minimum available business demand factor corresponding to the field; the minimum available business demand factor is used to characterize the degree of demand of the target business for the effective information in the field; and it determines the desensitization intensity corresponding to the field based on the real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business demand factor. The desensitization module 308 is used to desensitize each field in the queried target data object according to the desensitization strength corresponding to each field.

[0115] like Figure 4 As shown, in some embodiments, the device further includes: The risk value correction module 305 is used to determine the usage offset risk between the requested usage and the allowed usage corresponding to the access request; determine the context anomaly correction item; wherein, the context anomaly correction item is used to characterize the abnormal information in this access and to correct the real-time risk value; obtain the time window risk based on the distance of the access time of this access from the preset business time center; obtain the historical behavior anomaly risk based on the number of abnormal behaviors of the access subject of this access within the preset time; and correct the calculated real-time risk value based on the usage offset risk, the context anomaly correction item, the time window risk, and the historical behavior anomaly risk. The desensitization intensity determination module 306 is also used to determine the desensitization intensity of a field based on the corrected real-time risk value, comprehensive data security level, field sensitivity weight, and minimum available business requirement factor.

[0116] It should be understood that, unless otherwise expressly stated herein, there is no strict order restriction on the execution of the various steps in the processes involved in the above embodiments. Moreover, these steps or stages are not necessarily to be completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the steps or stages of other steps.

[0117] In some embodiments, a computer-readable storage medium is also provided, on which a computer program is stored. When executed by a processor, the computer program implements the various processes in the data hierarchical desensitization method involved in the above embodiments and achieves the same technical effect. To avoid repetition, it will not be described again. The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0118] In some embodiments, a computer device is also provided, comprising a processor and a memory connected to the processor. The memory stores a computer program executable by the processor. When executed by the processor, the computer program implements various processes in the data hierarchical desensitization method and achieves the same technical effect. To avoid repetition, further details are omitted here. The internal structure of the computer device may be as follows: Figure 5 As shown.

[0119] In some embodiments, a computer program product is also provided, including a computer program that, when executed by a processor, implements the various processes in the data hierarchical desensitization method and achieves the same technical effect. To avoid repetition, it will not be described in detail here.

[0120] It should be noted that any data or information used in executing the methods in this application embodiment (e.g., target data object, field sensitivity level, field identification quantification value, field association quantification value, regulatory sensitivity quantification value, etc.) are obtained after authorization.

[0121] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0122] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0123] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data hierarchical desensitization method, characterized in that, The method includes: In response to an access request targeting a specific business function, the target data object is obtained. Calculate the real-time risk value of this visit based on the business purpose attribute vector of the target business; Determine the comprehensive data security level corresponding to the target data object; For each field in the target data object, the field sensitivity weight corresponding to the field is determined based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value. Determine the minimum available business requirement factor corresponding to the field; the minimum available business requirement factor is used to characterize the degree of requirement of the target business for the effective information in the field; Determine the first coupling enhancement term between the comprehensive data security level and the real-time risk value; Determine a second coupling enhancement term between the field sensitivity weight and the real-time risk value; The nonlinear enhancement term for the high-risk interval is determined based on the real-time risk value; The desensitization intensity corresponding to the field is determined based on the real-time risk value, the comprehensive data security level, the field sensitivity weight, the minimum available business requirement factor, the first coupling enhancement term, the second coupling enhancement term, and the nonlinear enhancement term of the high-risk interval. Based on the desensitization strength corresponding to each field, desensitization processing is performed on each field in the queried target data object; The target data object includes an identifier field; the process of desensitizing each field in the queried target data object according to the desensitization strength of each field includes: The mixing coefficient is determined based on the desensitization intensity corresponding to the identifier field; the mixing coefficient is positively correlated with the desensitization intensity. The identifier field is de-identified using a masking function to obtain the masking result; The identifier field is de-identified according to the tokenization function to obtain the tokenization result; The masking result and the tokenization result are mixed according to the mixing coefficient to obtain the de-identification result corresponding to the identifier field; Before performing desensitization processing on each field in the queried target data object according to the desensitization strength corresponding to each field, the method further includes: Obtain the coefficient of basic information content of the field; For each field in the target data object, the usable information content of the field at the corresponding desensitization intensity is generated based on the desensitization intensity of the field and the basic information content coefficient of the field; the usable information content is used to measure the effective information retained by the field at the corresponding desensitization intensity. If the amount of available information does not meet the available information constraints, adjust the desensitization strength corresponding to the field. When the amount of available information in the field under the adjusted desensitization strength meets the available information constraint, the step of desensitizing each field in the queried target data object according to the desensitization strength corresponding to each field is executed.

2. The method according to claim 1, characterized in that, Determining the minimum available business requirement factor corresponding to the field includes: Determine the degree of dependency of the access subject's role on the field to obtain the role dependency. Determine the degree of dependency of the task corresponding to the target business on the field to obtain the task dependency degree; Determine the necessity of the fields when performing business functions in the business process to obtain the field function dependency; Determine the level of information allowed to be retained in the field after approval to obtain the approval exemption level; Based on the role dependency, the task dependency, the field function dependency, and the approval exemption, the minimum available business requirement factor corresponding to the field is obtained.

3. The method according to claim 1, characterized in that, The calculation of the real-time risk value for this access based on the business purpose attribute vector of the target business includes: Determine the access subject attribute vector and environment context attribute vector for this access; The real-time risk value of this access is calculated based on the business purpose attribute vector, the access subject attribute vector, and the environment context attribute vector.

4. The method according to claim 3, characterized in that, The step of calculating the real-time risk value of this access based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector includes: Determine the business purpose credibility factor based on the aforementioned business purpose attribute vector; The trust level of the access subject is determined based on the access subject attribute vector; Environmental risk factors are determined based on the environmental context attribute vector. The real-time risk value of this access is determined based on the business purpose credibility factor, the access subject credibility level, and the environmental risk factor.

5. The method according to claim 3, characterized in that, The step of calculating the real-time risk value of this access based on the business purpose attribute vector, the access subject attribute vector, and the environmental context attribute vector includes: The access subject attribute vector and the environment context attribute vector are combined element by element to obtain the first interaction vector; The access subject attribute vector and the business purpose attribute vector are combined element by element to obtain the second interaction vector; The real-time risk value of this access is calculated based on the business purpose attribute vector, the access subject attribute vector, the environment context attribute vector, the first interaction vector, and the second interaction vector.

6. The method according to claim 1, characterized in that, Before determining the first coupling enhancement term between the integrated data security level and the real-time risk value, the method further includes: Determine the risk of purpose offset between the requested purpose and the permitted purpose corresponding to the access request; Determine the context anomaly correction item; wherein, the context anomaly correction item is used to characterize the anomaly information in this access that is used to correct the real-time risk value; The time window risk is determined by the distance between the access time of this visit and the preset business time center. Based on the number of abnormal behaviors of the accessing entity within a preset time period, the historical abnormal behavior risk is obtained; The calculated real-time risk value is corrected based on the application offset risk, the context anomaly correction item, the time window risk, and the historical behavior anomaly risk. Based on the corrected real-time risk value, the first coupling enhancement term for determining the comprehensive data security level and the real-time risk value, and subsequent steps are executed to determine the desensitization strength corresponding to the field.

7. A data hierarchical desensitization device, characterized in that, The device includes: The data acquisition module is used to respond to access requests for the target business and obtain the target data object to be queried; The real-time risk assessment module is used to calculate the real-time risk value of this access based on the business purpose attribute vector of the target business. The desensitization intensity determination module is used to determine the comprehensive data security level corresponding to the target data object; for each field in the target data object, it determines the field sensitivity weight corresponding to the field based on the field sensitivity level, field identification quantification value, field correlation quantification value, and regulatory sensitivity quantification value corresponding to the field; it determines the minimum available business demand factor corresponding to the field; the minimum available business demand factor is used to characterize the degree of demand of the target business for the effective information in the field; it determines the first coupling enhancement term between the comprehensive data security level and the real-time risk value; it determines the second coupling enhancement term between the field sensitivity weight and the real-time risk value; it determines the nonlinear enhancement term of the high-risk interval based on the real-time risk value; and it determines the desensitization intensity corresponding to the field based on the real-time risk value, the comprehensive data security level, the field sensitivity weight, the minimum available business demand factor, the first coupling enhancement term, the second coupling enhancement term, and the nonlinear enhancement term of the high-risk interval. The desensitization module is used to desensitize each field in the queried target data object according to the desensitization strength corresponding to each field. The target data object includes an identifier field; the desensitization module is specifically used to determine a corresponding mixing coefficient based on the desensitization intensity corresponding to the identifier field; the mixing coefficient is positively correlated with the desensitization intensity. The identifier field is de-identified using a masking function to obtain the masking result; The identifier field is de-identified according to the tokenization function to obtain the tokenization result; The masking result and the tokenization result are mixed according to the mixing coefficient to obtain the de-identification result corresponding to the identifier field; Before the desensitization module performs the step of desensitizing each field in the queried target data object according to the desensitization strength corresponding to each field, the desensitization strength determination module is further used for: Obtain the coefficient of basic information content of the field; For each field in the target data object, the usable information content of the field at the corresponding desensitization intensity is generated based on the desensitization intensity of the field and the basic information content coefficient of the field; the usable information content is used to measure the effective information retained by the field at the corresponding desensitization intensity. If the amount of available information does not meet the available information constraints, adjust the desensitization strength corresponding to the field. When the amount of available information in the field under the adjusted desensitization strength meets the available information constraint, the step of desensitizing each field in the queried target data object according to the desensitization strength corresponding to each field is executed.

Images