Metadata-driven questionnaire dynamic configuration and two-stage anonymous desensitization method and system

Abstract

The application discloses a metadata-driven questionnaire dynamic configuration and double-stage anonymous desensitization method and system, constructs a metadata configuration table, and dynamically matches a questionnaire metadata block to generate a configuration script according to a multi-dimensional identity vector of an answerer, solves the problems of high questionnaire maintenance cost and poor expansibility of a traditional hard coding mode under a multi-level organization architecture, realizes rapid deployment and dynamic rendering of dozens of personalized questionnaires, removes physical feature data through local physical fusing, generates anonymous credentials based on a work number and a batch number, combines a double-layer encryption strategy of symmetric encryption of a session key and asymmetric encryption of a server public key, solves the risks of man-in-the-middle attacks and identity reverse derivation in a conventional transmission link, and improves the whole-link anonymous guarantee level, sets an anonymity threshold to control the number of statistical slice samples, solves the problem of identity leakage caused by intersection analysis in a small sample scene, and realizes safe collection and anonymous statistical analysis of sensitive evaluation data.

Description

Technical Field

[0001] This invention relates to the fields of computer software, network security and human resource management technology, and in particular to a metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method and system. Background Technology

[0002] When companies conduct large-scale talent reviews and company-wide evaluations, the organizational structure typically extends vertically to multiple levels, including subsidiary headquarters, departments, second-tier, third-tier, and fourth-tier organizations. The evaluation dimensions and key personnel recommendation indicators differ significantly across these levels and positions. Traditional solutions often employ hard-coding to develop front-end pages for each questionnaire individually, or create separate configuration libraries for each questionnaire in the backend. When the organizational structure is adjusted or the indicator system is iterated, significant manpower is required for item-by-item maintenance. Furthermore, the system lacks scalability and struggles to support the rapid deployment of dozens of personalized questionnaires.

[0003] Existing questionnaire systems generally lack the ability to perceive the multi-dimensional identity tags of respondents in real time. They cannot achieve dynamic scene assembly and precise routing based on information such as hierarchy, organizational level, and departmental affiliation. It is difficult to achieve personalized delivery effects such as one route per person and one matrix per position. Furthermore, they cannot dynamically retrieve and inject a list of key candidates that matches the respondent's organization and professional department, which restricts the accurate identification of talents in vertical and segmented fields.

[0004] Furthermore, employee evaluations often involve sensitive indicators and objective assessments of superiors. Existing systems largely rely on conventional HTTPS encryption, leaving the transmission link vulnerable to advanced man-in-the-middle attacks. The front-end network transmission layer still retains traceable features such as IP addresses and device fingerprints, while the back-end lacks a multi-dimensional cross-analysis and circuit breaker mechanism. The identity of respondents could be deduced through intersection analysis, indicating significant deficiencies in end-to-end anonymity and encryption protection.

[0005] Therefore, there is an urgent need to provide a technical solution to address the above problems. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a metadata-driven method and system for dynamic questionnaire configuration and two-stage anonymization and desensitization.

[0007] In a first aspect, the present invention provides a metadata-driven method for dynamic configuration of questionnaires and two-stage anonymization and desensitization, the technical solution of which is as follows: Based on the respondent's multidimensional identity vector, the corresponding target questionnaire metadata block is matched from the metadata configuration table, and the questionnaire configuration script corresponding to the respondent is generated based on the target questionnaire metadata block. The questionnaire page is rendered based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, a physical circuit breaker operation is performed locally to clear the physical feature data and generate an anonymous credential based on the respondent's employee number and the current questionnaire batch number. The questionnaire data is symmetrically encrypted using a session key, and the session key is asymmetrically encrypted using a server public key. The encrypted questionnaire data and the encrypted session key are then encapsulated into a data packet, which is then sent to the server. Receive the anonymization storage confirmation information returned by the server, the anonymization storage confirmation information being used to characterize the state of the anonymization credential being stored separately from the questionnaire data; In response to a statistical request for submitted questionnaire data, the system obtains the number of samples corresponding to the statistical slice. When the number of samples is less than a preset anonymity threshold, the system returns aggregated dimension data to the requester.

[0008] The beneficial effects of the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention are as follows: The method of this invention solves the problems of high questionnaire maintenance costs and poor scalability in multi-level organizational structures caused by traditional hard-coding methods by constructing a metadata configuration table and dynamically matching questionnaire metadata blocks based on the respondent's multi-dimensional identity vector to generate configuration scripts. It enables the rapid deployment and dynamic rendering of dozens of personalized questionnaires. By clearing physical feature data through local physical circuit breaking and generating anonymous credentials based on employee ID and batch number, combined with a two-layer encryption strategy of symmetric encryption of session keys and asymmetric encryption of server public keys, the risk of man-in-the-middle attacks and reverse identity deduction in conventional transmission links is solved, improving the level of anonymity protection across the entire link. By setting an anonymity threshold to control the number of statistical slice samples, the problem of identity leakage caused by intersection analysis in small sample scenarios is solved, realizing the secure collection and anonymized statistical analysis of sensitive evaluation data.

[0009] Based on the above scheme, the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention can be further improved as follows.

[0010] In one alternative approach, the step of matching the corresponding target questionnaire metadata block from the metadata configuration table based on the respondent's multidimensional identity vector includes: Using the multidimensional identity vector as an index, the scenario routing matrix in the metadata configuration table is traversed to query the preset configuration entries that match the values ​​of each dimension in the multidimensional identity vector. The metadata blocks pointed to by the preset configuration entries are combined to determine the target questionnaire metadata block. Each configuration entry in the scenario routing matrix is ​​associated with a set of hierarchical threshold ranges, organizational level identifiers, and business line identifiers.

[0011] The advantages of adopting the above optional methods are as follows: by further leveraging the scenario routing matrix to associate and map the multidimensional identity vector with the hierarchical threshold range, the organization level identifier, and the business line identifier, the questionnaire metadata block has multidimensional indexing capabilities, avoids configuration deviations caused by single condition matching, and improves the accuracy of questionnaire delivery under complex organizational structures.

[0012] In one alternative approach, the step of generating the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block includes: Parse the question type metadata, indicator metadata, and entity metadata reference fields in the target questionnaire metadata block; Based on the organization level information in the multidimensional identity vector, retrieve the dynamic personnel list corresponding to the organization of the respondent from the entity metadata; The question type metadata, the indicator metadata, and the dynamic personnel list are assembled into the questionnaire configuration script according to a preset JSONSchema template, and the dynamic personnel list is injected into the option data source field of the questionnaire configuration script.

[0013] The advantages of adopting the above optional method are as follows: by further parsing the question type metadata, indicator metadata and entity metadata reference fields, and dynamically retrieving the personnel list based on the organization level information and injecting it into the option data source, the questionnaire configuration script can be automatically updated as the organizational structure changes, reducing the workload of manual maintenance and ensuring the relevance of the questionnaire content to the actual work scenario of the respondents.

[0014] In one alternative approach, the steps of performing a physical circuit breaker operation locally and clearing physical characteristic data include: The cache address of the physical feature data stored in local memory is scanned by the edge interception fuse; Write random overwrite data to the storage area corresponding to the cache address to overwrite the original physical feature data, and release the storage area after the overwrite is completed; Send a memory reclamation confirmation request to the operating system of the client device, and obtain a confirmation signal from the operating system that the storage area has been reclaimed.

[0015] The beneficial effects of adopting the above optional method are as follows: further scanning the cache address of physical feature data in local memory through edge interception fuse, writing random overwrite data to the corresponding storage area to overwrite the original content, and sending a memory reclamation confirmation request to the operating system after the overwrite is completed, so that the physical feature data is completely erased locally and cannot be recovered, blocking the path of reverse tracing the identity of the answerer through device fingerprint.

[0016] In one alternative approach, the step of generating an anonymous credential based on the respondent's employee ID and the current questionnaire batch number includes: The employee ID and the current questionnaire batch number are concatenated in binary to obtain a concatenated sequence. A salt value sequence randomly generated by the server is obtained. The concatenated sequence and the salt value sequence are combined and then input into a hash function. The hash value output by the hash function is used as the anonymity credential.

[0017] The beneficial effects of adopting the above optional method are as follows: by further concatenating the employee number and the questionnaire batch number into binary and then introducing the random salt value on the server for hash operation, the generation process of anonymous credentials has both time-varying and random characteristics. Even if the credentials generated by the same respondent in different batches are not related to each other, the risk of credentials being brute-forced or cross-batch comparison to restore the real identity is reduced.

[0018] In one alternative approach, the steps of symmetric encryption of the questionnaire data using a session key and asymmetric encryption of the session key using a server public key include: The client randomly generates the session key locally and obtains the server's public key from the server. The questionnaire data is divided into multiple data groups according to a preset group length. An initialization vector is obtained and used as the first pre-ciphertext. For each data group, the data group and the pre-ciphertext are XORed and then symmetrically encrypted using the SM4 encryption function. The corresponding group ciphertext is output and used as the pre-ciphertext for the next data group. After all the data groups are encrypted, all the group ciphertexts are combined in sequence to form the encrypted questionnaire data. The session key is input into the SM2 encryption function, and the session key is encrypted using the server public key to generate the encrypted session key.

[0019] The beneficial effects of adopting the above optional methods are as follows: by further combining SM4 block encryption with chained processing of initialization vector and pre-ciphertext XOR, and SM2 elliptic curve encryption to protect the session key, the questionnaire data forms a double layer of protection of symmetric and asymmetric encryption during transmission. Even if the transmission link is intercepted, attackers cannot directly obtain the plaintext questionnaire content or session key.

[0020] In one alternative approach, the step of encapsulating the encrypted questionnaire data and the encrypted session key into a data packet includes: The ciphertext data output by the symmetric encryption is obtained as the encrypted questionnaire data, and the key ciphertext output by the asymmetric encryption is obtained as the encrypted session key. According to the preset message format, the encrypted session key is used as the envelope header field, and the encrypted questionnaire data is used as the data payload field, which are combined into the data packet with the digital envelope structure. The data packet does not contain the respondent's real identity identifier or physical characteristic data.

[0021] The beneficial effects of adopting the above optional method are as follows: by combining the encrypted session key as the envelope header field and the encrypted questionnaire data as the data payload field into a digital envelope structure, and removing the real identity identifier and physical feature data from the data packet, the transmitted message only carries encrypted content and has no traceable information, thus severing the association channel between identity and questionnaire data at the message structure level.

[0022] Secondly, this invention provides a metadata-driven questionnaire dynamic configuration and two-stage anonymity desensitization system, the technical solution of which is as follows: The configuration module is used to match the corresponding target questionnaire metadata block from the metadata configuration table based on the respondent's multidimensional identity vector, and generate the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block; The generation module is used to render the questionnaire page based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, a physical circuit breaker operation is performed locally to clear the physical feature data, and an anonymous credential is generated based on the respondent's employee number and the current questionnaire batch number. The encapsulation module is used to symmetrically encrypt the questionnaire data using a session key, asymmetrically encrypt the session key using a server public key, encapsulate the encrypted questionnaire data and the encrypted session key into a data packet, and send the data packet to the server. The receiving module is used to receive the anonymized storage confirmation information returned by the server, wherein the anonymized storage confirmation information is used to characterize the state of the anonymized credentials being stored separately from the questionnaire data; The return module is used to respond to statistical requests for submitted questionnaire data, obtain the number of samples corresponding to the statistical slice, and return aggregated dimension data to the requester when the number of samples is less than a preset anonymity threshold.

[0023] The beneficial effects of the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system of the present invention are as follows: The system of this invention solves the problems of high questionnaire maintenance costs and poor scalability in multi-level organizational structures caused by traditional hard-coding methods by constructing a metadata configuration table and dynamically matching questionnaire metadata blocks based on the respondent's multi-dimensional identity vector to generate configuration scripts. It enables the rapid deployment and dynamic rendering of dozens of personalized questionnaires. By clearing physical feature data through local physical circuit breaking and generating anonymous credentials based on employee ID and batch number, and combining a two-layer encryption strategy of symmetric encryption of session keys and asymmetric encryption of server public keys, it solves the risks of man-in-the-middle attacks and reverse identity deduction in conventional transmission links, and improves the level of anonymity protection across the entire link. By setting an anonymity threshold to control the number of statistical slice samples, it solves the problem of identity leakage caused by intersection analysis in small sample scenarios, and realizes the secure collection and anonymized statistical analysis of sensitive evaluation data.

[0024] Thirdly, the technical solution of an electronic device according to the present invention is as follows: It includes a memory, a processor, and a program stored in the memory and running on the processor, wherein the processor executes the program to implement the steps of the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention.

[0025] Fourthly, the technical solution of a computer-readable storage medium provided by the present invention is as follows: The computer-readable storage medium stores instructions that, when read, cause the computer-readable storage medium to perform the steps of the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention.

[0026] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other objects, features and advantages of the present invention more obvious and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0027] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a flowchart illustrating an embodiment of a metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to the present invention. Figure 2 This is a schematic diagram of an embodiment of a metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system according to the present invention. Figure 3 This is a schematic diagram of an embodiment of an electronic device according to the present invention. Detailed Implementation

[0028] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0029] Figure 1 This diagram illustrates a flowchart of an embodiment of a metadata-driven dynamic questionnaire configuration and two-stage anonymization desensitization method provided by the present invention. This method can be executed by electronic devices such as terminal devices or servers. The terminal device can be any fixed or mobile terminal, such as a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, in-vehicle device, or wearable device. The server can be a single server or a server cluster consisting of multiple servers. Any electronic device can implement the metadata-driven dynamic questionnaire configuration and two-stage anonymization desensitization method by having its processor call computer-readable instructions stored in its memory. Figure 1 As shown, it includes the following steps: S1. Based on the respondent's multidimensional identity vector, match the corresponding target questionnaire metadata block from the metadata configuration table, and generate the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block.

[0030] In this context, "respondent" refers to a natural person who, during a company's talent review or employee evaluation activities, is required to complete a questionnaire and respond to relevant evaluation indicators. For example, Employee A is an employee of Business Line X at Branch A of a large insurance group and participates in the annual talent review activity launched on June 1, 2026, as a respondent. A multidimensional identity vector refers to a combination of identity tags composed of the respondent's hierarchical information, organizational level information, and business line information, used to represent the respondent's multidimensional position within the organizational structure. For example, Employee A's multidimensional identity vector is {Hierarchy = Employee Level, Organizational Level = Third-Level Organization, Business Line Identifier = Business Line X}.

[0031] The metadata configuration table refers to a pre-configured set of settings containing question type metadata, indicator metadata, and entity metadata. This set stores the atomic definitions of the questionnaire and dynamic personnel lists under different organizational structures. For example, the metadata configuration table stored in the backend includes metadata for the "single-choice" question type, metadata for the "growth potential" indicator, and entity metadata for the dynamic personnel list of business line X in branch A's third-level organization. The target questionnaire metadata block refers to a set of metadata composed of question type metadata, indicator metadata, and entity metadata, matched from the metadata configuration table based on the respondent's multi-dimensional identity vector. For example, based on employee A's multi-dimensional identity vector {level = employee, organization level = third-level organization, business line identifier = business line X}, the backend matches the target questionnaire metadata block from the metadata configuration table, containing the "single-choice" question type, five evaluation indicators, and the personnel list of business line X in branch A's third-level organization.

[0032] The questionnaire configuration script refers to a structured configuration file generated by assembling the target questionnaire metadata block according to a JSON Schema template. This file is used by the front-end rendering engine to render an interactive questionnaire page. For example, the back-end assembles the "single choice" question type, "growth potential" and other indicators, as well as the dynamic personnel list from Employee A's target questionnaire metadata block into a questionnaire configuration script containing a complete question structure and option data source according to a JSON Schema template.

[0033] S2. Render the questionnaire page based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, perform a physical circuit breaker operation locally to clear the physical feature data and generate an anonymous credential based on the respondent's employee number and the current questionnaire batch number.

[0034] The questionnaire page refers to the visual interactive interface displayed to the respondent in a browser or client for completion, generated based on the questionnaire configuration script. For example, the browser renders a questionnaire page containing multiple single-choice questions, evaluation scale questions, and key personnel recommendation options based on employee A's questionnaire configuration script. Employee A fills in the evaluation content for each question on this page. The questionnaire data refers to all the responses filled in by the respondent on the questionnaire page, including the selection results for each question, text opinions, and recommended personnel selection information. For example, employee A filled in ratings for five colleagues, three text opinions, and recommended employee B as a key personnel candidate on the questionnaire page; these contents together constitute employee A's questionnaire data.

[0035] The physical circuit breaker operation refers to the operation of immediately erasing and discarding physical characteristic data on the client's local machine when the respondent submits the questionnaire. For example, the moment employee A clicks the submit button, the client's edge interception circuit breaker is immediately activated, scanning and locating the cache address of employee A's physical characteristic data stored in local memory. Physical characteristic data refers to physical-level characteristic information that can uniquely identify or track the respondent's terminal device, including IP address and device fingerprint, where the device fingerprint includes the device MAC address. For example, the client's local memory stores employee A's IP address "192.168.1.100" and device MAC address "AA:BB:CC:DD:EE:FF".

[0036] Here, "employee ID" refers to a unique identifier assigned to each employee by the company, used to uniquely identify the respondent internally; for example, employee A's employee ID in the company's human resources system is E20260701. "Current questionnaire batch number" refers to a unique code identifying the batch of this questionnaire survey activity, used to distinguish questionnaire survey activities conducted at different times or for different purposes; for example, the batch number for this annual talent review questionnaire survey activity is PD2026-001.

[0037] The anonymous credential refers to a unique identifier generated by concatenating the respondent's employee ID with the current questionnaire batch number, adding a random salt value, and performing an irreversible one-way hash calculation. This identifier is used to mark response records without revealing the respondent's true identity. For example, the backend concatenates employee A's employee ID E20260701 with the batch number PD2026-001 in binary format and adds a randomly generated salt value. (Value is "S8xK2mN9"), execute The calculated anonymous credentials are: "a7f3d8e9c2b1a6f4e8d3c7b9a2f5e1d4c8b7a6f3e9d2c5b8a7f4e1d3c6b9a2".

[0038] S3. The questionnaire data is symmetrically encrypted using a session key, and the session key is asymmetrically encrypted using a server public key. The encrypted questionnaire data and the encrypted session key are encapsulated into a data packet and sent to the server.

[0039] The session key refers to a symmetric key randomly generated locally by the client during this questionnaire submission session, used for symmetric encryption of the questionnaire data. For example, after employee A clicks submit, the client randomly generates a 128-bit session key. This key is only used in this session and expires after the session ends. The server public key refers to the public key portion of a key pair pre-generated by the server based on the SM2 asymmetric encryption algorithm, used for asymmetric encryption of the session key. For example, the client requests the SM2 public key for the current batch from the server. The public key is the public portion of a key pair pre-generated by the server.

[0040] Here, a data packet refers to a data unit that assembles a digital envelope structure, with the encrypted questionnaire data as the data payload and the encrypted session key as the envelope header, according to a preset message format. For example, the client uses the SM4-encrypted ciphertext of employee A's questionnaire as the data payload and the SM2-encrypted ciphertext of the session key as the envelope header, and assembles them into a complete digital envelope structure data packet according to a preset message format.

[0041] The server refers to a server or server cluster that receives and processes questionnaire data packets submitted by the client, performs decryption, anonymization, separate storage, and statistical circuit breaking. For example, the client sends the assembled digital envelope structure data packet to the server over the network, and the server receives it and uses the SM2 private key... Unpack the digital envelope.

[0042] S4. Receive the anonymization storage confirmation information returned by the server. The anonymization storage confirmation information is used to characterize the state of the anonymization credential being stored separately from the questionnaire data.

[0043] The anonymized storage confirmation message refers to the confirmation message returned by the server to the client after the anonymized credentials and questionnaire data have been separated and stored. It indicates that the anonymized credentials and questionnaire data have been stored in mutually isolated channels. For example, the server uses an asynchronous dual-channel writing method to record employee A's anonymized credentials in the first channel and the questionnaire data in the second channel, and then returns the anonymized storage confirmation message "storage successful" to the client.

[0044] S5. In response to a statistical request for submitted questionnaire data, obtain the number of samples corresponding to the statistical slice. When the number of samples is less than a preset anonymity threshold, return aggregated dimension data to the requester.

[0045] Submitted questionnaire data refers to the questionnaire data that, after being completed and submitted by the respondent, undergoes physical circuit breaking, anonymization, and encrypted transmission before being stored on the server. For example, employee A's submitted questionnaire data, after physical circuit breaking, anonymization credential generation, and encrypted transmission, is stored in an anonymized form in the server's second channel, becoming submitted questionnaire data. A statistical request refers to a query request initiated by authorized personnel or the backend to perform aggregated statistical analysis on submitted questionnaire data. For example, Human Resources Manager B initiates a statistical request to the backend to query the "Distribution of X Growth Potential Indicator Scores for the Third-Level Organizations of Branch Company A".

[0046] In this context, a statistical slice refers to a specific subset of data used for statistical analysis, formed by the cross-combination of one or more dimensions. For example, the backend combines the dimensions "Branch A's Third-Level Organization" and "Business Line X" to form a statistical slice. The sample size refers to the number of submitted questionnaire data entries in the statistical slice that meet the dimension criteria. For example, the statistical slice "Branch A's Third-Level Organization + Business Line X" contains 6 submitted questionnaire data entries, which is the sample size. It is 6.

[0047] The preset anonymity threshold refers to the minimum sample size threshold set in advance to determine whether to allow the display of detailed statistical slice data; for example, the preset anonymity threshold... Detailed data for a statistical slice can only be displayed when the number of samples reaches 5 or more.

[0048] In this context, the requester refers to the individual or backend that initiates the statistical request and receives the returned statistical results. For example, Human Resources Manager B is the requester, and the backend returns aggregated dimension data of the statistical slice to them. Aggregated dimension data refers to the summary statistical data generated after aggregating the statistical slice to the next higher-level dimension, which cannot be used to infer individual identities. For example, when the sample size in the statistical slice "Branch A's third-level organization + business line X" is 3, which is less than the preset anonymity threshold of 5, the algorithm circuit breaker is triggered, refusing to display detailed data and aggregating the slice to the "Branch A" level, returning the average summary score of business line X of Branch A to Manager B.

[0049] The technical solution of this embodiment solves the problems of high questionnaire maintenance cost and poor scalability in multi-level organizational structures caused by traditional hard-coding methods by constructing a metadata configuration table and dynamically matching questionnaire metadata blocks based on the multi-dimensional identity vector of the respondents to generate configuration scripts. This enables the rapid deployment and dynamic rendering of dozens of personalized questionnaires. By clearing physical feature data through local physical circuit breaking and generating anonymous credentials based on employee ID and batch number, combined with a two-layer encryption strategy of symmetric encryption of session keys and asymmetric encryption of server public keys, the risk of man-in-the-middle attacks and reverse identity deduction in conventional transmission links is solved, improving the level of anonymity protection across the entire link. By setting an anonymity threshold to control the number of statistical slice samples, the problem of identity leakage caused by intersection analysis in small sample scenarios is solved, realizing the secure collection and anonymized statistical analysis of sensitive evaluation data.

[0050] In one alternative approach, the step of matching the corresponding target questionnaire metadata block from the metadata configuration table based on the respondent's multidimensional identity vector includes: Using the multidimensional identity vector as an index, the scenario routing matrix in the metadata configuration table is traversed to query the preset configuration entries that match the values ​​of each dimension in the multidimensional identity vector. The metadata blocks pointed to by the preset configuration entries are combined to determine the target questionnaire metadata block.

[0051] The scenario routing matrix refers to a two-dimensional mapping table composed of multiple preset configuration entries, used to query and match target questionnaire metadata blocks based on the dimension values ​​of multi-dimensional identity vectors. For example, the scenario routing matrix contains various combinations such as configuration entries for employees of business line X in the third-level organization of branch A, and configuration entries for managers of business line Y in the second-level organization of branch A. The backend traverses the matrix using employee A's multi-dimensional identity vector as an index. Preset configuration entries refer to configuration records in the scenario routing matrix that are pre-configured, associated with a set of hierarchical threshold intervals, organizational level identifiers, and business line identifiers, and point to the corresponding metadata block combination. For example, a preset configuration entry in the scenario routing matrix is ​​associated with the hierarchical threshold interval "employee level," the organizational level identifier "third-level organization," and the business line identifier "business line X," and this entry points to a metadata block combination specific to employees of business line X.

[0052] Each configuration entry in the scenario routing matrix is ​​associated with a set of hierarchical threshold ranges, organizational level identifiers, and business line identifiers.

[0053] The level threshold range refers to the numerical or grade range in the preset configuration entries used to define the level range of the respondent; for example, the level threshold range in the preset configuration entries is "employee level", which covers all personnel at the ordinary employee level in the enterprise.

[0054] The organization level identifier refers to the code in the preset configuration entry used to identify the level of the respondent's organization within the organizational structure; for example, the organization level identifier in the preset configuration entry is "Level 3 Organization," corresponding to the organization level of employee A. The business line identifier refers to the code in the preset configuration entry used to identify the professional business line to which the respondent belongs; for example, the business line identifier in the preset configuration entry is "Business Line X," corresponding to the business line to which employee A belongs.

[0055] Among the above optional methods, the multi-dimensional identity vector is further associated and mapped with the hierarchical threshold range, organizational level identifier and business line identifier by using the scenario routing matrix. This enables the questionnaire metadata block to have multi-dimensional indexing capabilities, avoids configuration deviations caused by single condition matching, and improves the accuracy of questionnaire delivery under complex organizational structures.

[0056] In one alternative approach, the step of generating the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block includes: Parse the question type metadata, indicator metadata, and entity metadata reference fields in the target questionnaire metadata block.

[0057] The question type metadata refers to the atomic data in the metadata configuration table that defines the questionnaire question types, including single-choice, multiple-choice, multi-dimensional matrix, and compound fill-in-the-blank questions. For example, the metadata configuration table contains the question type metadata for the "Growth Potential" multi-dimensional matrix question, which defines the question type as a multi-dimensional matrix question and the matrix's row and column structure. The indicator metadata refers to the atomic data in the metadata configuration table that defines the evaluation indicator name and evaluation dimension. For example, the metadata configuration table contains indicator metadata such as "Growth Potential," "Problem-Solving Ability," "Collaboration," and "Professional Ability," with each indicator metadata including the indicator name and evaluation standard description. The entity metadata reference field refers to the reference field in the target questionnaire metadata block that points to the entity metadata storage location, used to obtain the dynamic personnel list when generating the questionnaire configuration script. For example, the entity metadata reference field in the target questionnaire metadata block stores a reference address pointing to the entity metadata of business line X of branch company A's third-level organization.

[0058] Based on the organization level information in the multidimensional identity vector, a dynamic personnel list corresponding to the organization to which the respondent belongs is retrieved from the entity metadata.

[0059] Here, "organizational level information" refers to the level identifier of the respondent's organization within the organizational structure; for example, the organizational level information corresponding to Employee A's third-level organization in the organizational structure is "third-level organization". "Dynamic personnel list" refers to the list of organizational personnel stored in the entity metadata that can be dynamically retrieved based on the respondent's organizational level and business line; for example, the dynamic personnel list of business line X of the third-level organization of Branch A stored in the entity metadata is {Employee B, Employee C, Employee D, Employee E, Employee F}.

[0060] The question type metadata, the indicator metadata, and the dynamic personnel list are assembled into the questionnaire configuration script according to a preset JSONSchema template, and the dynamic personnel list is injected into the option data source field of the questionnaire configuration script.

[0061] The JSON Schema template refers to a standardized template file used to define the data structure of the questionnaire configuration script. It specifies the field names, data types, and filling rules for the option data source fields of each question type in the questionnaire. For example, the preset JSON Schema template includes the structure definition of the "question type" field, the "indicator" field, and the "option data source" field. By filling the question type metadata, indicator metadata, and dynamic personnel list into the corresponding positions according to the template, the questionnaire configuration script for employee A is generated.

[0062] The option data source field refers to the field in the questionnaire configuration script used to store the dynamic personnel list. The content of this field is filled by the dynamic personnel list in the entity metadata when the script is generated. For example, after the option data source field in the questionnaire configuration script is filled by the dynamic personnel list {Employee B, Employee C, Employee D, Employee E, Employee F} in the entity metadata, Employee A can only select from this list when recommending key personnel on the questionnaire page.

[0063] Among the above optional methods, further by parsing the question type metadata, indicator metadata, and entity metadata reference fields, and dynamically retrieving the personnel list based on the organization level information and injecting it into the option data source, the questionnaire configuration script can be automatically updated as the organizational structure changes, reducing the workload of manual maintenance and ensuring the relevance of the questionnaire content to the actual work scenarios of the respondents.

[0064] In one alternative approach, the steps of performing a physical circuit breaker operation locally and clearing physical characteristic data include: The cache address of the physical feature data stored in local memory is scanned by the edge interception fuse.

[0065] The edge intercept circuit breaker refers to a program component running on the client side that is activated when the respondent triggers the questionnaire submission event. It is responsible for scanning the physical feature data storage address and performing a physical circuit breaker operation. For example, the moment employee A clicks the submit button, the edge intercept circuit breaker in the client is triggered and begins scanning the physical feature data cache address. The cache address refers to the physical memory address where the physical feature data is stored in the client's local memory. For example, after scanning, the edge intercept circuit breaker locates employee A's IP address "192.168.1.100" stored at local memory address 0x7FFF3A2C, and the device MAC address "AA:BB:CC:DD:EE:FF" stored at local memory address 0x7FFF3A30. These two addresses are the cache addresses.

[0066] Write random overwrite data to the storage area corresponding to the cache address to overwrite the original physical feature data, and release the storage area after the overwrite is completed.

[0067] The random overwrite data refers to a random string or random byte sequence generated by the client to overwrite the original physical characteristic data storage area. For example, the edge-intercepting circuit breaker generates the random byte sequence "7F3A9C2E5B1D8F4A" as random overwrite data and writes this sequence into the storage area corresponding to the cache address of employee A's IP address and device MAC address. The original physical characteristic data refers to the unmodified physical characteristic data stored in the client's local memory before the physical circuit breaker operation is executed. For example, before the edge-intercepting circuit breaker writes the random overwrite data, the employee A's IP address "192.168.1.100" and MAC address "AA:BB:CC:DD:EE:FF" stored in the client's local memory are the original physical characteristic data.

[0068] Send a memory reclamation confirmation request to the operating system of the client device, and obtain a confirmation signal from the operating system that the storage area has been reclaimed.

[0069] Here, "client" refers to the terminal application or browser used by the respondent to access the questionnaire page, fill out and submit the questionnaire; for example, if employee A accesses the questionnaire system through a browser, that browser is the client. "Operating system" refers to the underlying software of the device where the client resides, responsible for managing hardware resources, memory allocation and reclamation; for example, the operating system installed on the laptop used by employee A is the operating system of the device where the client resides.

[0070] The memory reclamation confirmation request refers to the request sent by the client to the operating system after completing the overwrite and release operations on the cached address storage area, confirming that the storage area has been reclaimed by the operating system. For example, after releasing the storage areas corresponding to employee A's IP address and device MAC address, the edge interception circuit breaker sends a memory reclamation confirmation request to the operating system to confirm that these two storage areas have been reclaimed. The confirmation signal refers to the response signal returned by the operating system to the client after completing the memory reclamation operation, confirming that the storage area has been reclaimed. For example, after reclaiming the storage areas corresponding to employee A's IP address and device MAC address, the operating system returns a "reclamation successful" confirmation signal to the client.

[0071] In the above optional methods, the cache address of physical feature data in local memory is further scanned by the edge interception fuse, and random overwrite data is written to the corresponding storage area to overwrite the original content. After the overwrite is completed, a memory reclamation confirmation request is sent to the operating system, so that the physical feature data is completely erased locally and cannot be recovered, blocking the path of reverse tracing the identity of the answerer through device fingerprint.

[0072] In one alternative approach, the step of generating an anonymous credential based on the respondent's employee ID and the current questionnaire batch number includes: The employee ID and the current questionnaire batch number are concatenated in binary to obtain a concatenated sequence. A salt value sequence randomly generated by the server is obtained. The concatenated sequence and the salt value sequence are combined and then input into a hash function. The hash value output by the hash function is used as the anonymity credential.

[0073] The concatenation sequence refers to the binary sequence obtained by concatenating the respondent's employee ID with the current questionnaire batch number. For example, the backend concatenates the binary representation of employee A's employee ID E20260701 with the binary representation of batch number PD2026-001 to obtain the complete concatenation sequence. The salt value sequence refers to a random binary sequence randomly generated by the server and used to combine with the concatenation sequence and input into a hash function to enhance the irreversibility of anonymous credentials. For example, the server generates a random salt value sequence. The salt value sequence (with the value "S8xK2mN9") is combined with the concatenated sequence of employee A and then input into the hash function.

[0074] Here, a hash function refers to a function that converts input data of arbitrary length into a fixed-length output value through irreversible one-way computation. For example, the backend combines employee A's concatenated sequence with the salt value sequence "S8xK2mN9" and inputs it into the HMAC-SHA256 hash function. This function performs irreversible one-way hash computation and outputs a fixed-length hash value. A hash value refers to a fixed-length numerical value output by the hash function after performing irreversible one-way computation on the input data. For example, after the HMAC-SHA256 hash function calculates the combined input sequence and salt value sequence of employee A, the output hash value is "a7f3d8e9c2b1a6f4e8d3c7b9a2f5e1d4c8b7a6f3e9d2c5b8a7f4e1d3c6b9a2", which serves as employee A's anonymous credential.

[0075] In the above-mentioned optional methods, the generation process of anonymous credentials is further improved by concatenating the employee number and the questionnaire batch number into binary and then introducing a random salt value on the server for hashing. This makes the generation process of anonymous credentials both time-varying and random. Even if the credentials generated by the same respondent in different batches are not related to each other, the risk of credentials being brute-forced or cross-batch comparison to restore the real identity is reduced.

[0076] In one alternative approach, the steps of symmetric encryption of the questionnaire data using a session key and asymmetric encryption of the session key using a server public key include: The client randomly generates the session key locally and obtains the server's public key from the server.

[0077] The questionnaire data is divided into multiple data groups according to a preset grouping length. An initialization vector is obtained and used as the first pre-ciphertext. For each data group, the data group and the pre-ciphertext are XORed and then input into the SM4 encryption function for symmetric encryption. The corresponding group ciphertext is output and used as the pre-ciphertext for the next data group. After all the data groups are encrypted, all the group ciphertexts are combined in sequence to form the encrypted questionnaire data.

[0078] The preset block length refers to the bit length of each data block predefined in the SM4 symmetric encryption algorithm. For example, the preset block length of the SM4 encryption algorithm is 128 bits, and the backend divides employee A's questionnaire data into multiple data blocks of 128 bits each. A data block refers to each independent block of data to be encrypted after the questionnaire data is divided according to the preset block length. For example, employee A's questionnaire data has a total length of 2560 bits, and is divided into 20 data blocks according to the preset block length of 128 bits.

[0079] The initialization vector refers to a random initial data block used in the SM4-CBC block cipher linking mode to perform an XOR operation with the first data block; for example, the client randomly generates a 128-bit initialization vector. The initialization vector is used as the first preorder ciphertext, and after XORing it with the first data block of employee A, it is input into the SM4 encryption function.

[0080] The SM4 encryption function refers to an encryption function that executes the SM4 block cipher linking mode symmetric encryption algorithm, used to symmetrically encrypt input data blocks and output the corresponding block ciphertext; for example, the client combines employee A's first data block with the initialization vector. The result of the XOR operation is input into the SM4 encryption function. The SM4 encryption function outputs the first block ciphertext and uses it as the preamble for the next data block.

[0081] The session key is input into the SM2 encryption function, and the session key is encrypted using the server public key to generate the encrypted session key.

[0082] The SM2 encryption function refers to an encryption function that executes the national standard SM2 asymmetric encryption algorithm, used to perform elliptic curve cryptography on the session key using the server's public key and output the key ciphertext; for example, the client sends employee A's session key... Input SM2 encryption function The SM2 encryption function utilizes the server's SM2 public key. Session key Perform elliptic curve cryptography to generate the key ciphertext.

[0083] Elliptic curve encryption refers to asymmetric encryption operations based on elliptic curve mathematical theory, using the server's public key to encrypt the session key, ensuring that only the server holding the corresponding private key can decrypt the session key. For example, the SM2 encryption function utilizes the server's SM2 public key. Based on the mathematical problem of elliptic curve discrete logarithm, the session key for employee A. Perform elliptic curve cryptography to generate a key ciphertext that only the server can decrypt.

[0084] Among the above optional methods, SM4 block encryption combined with chained processing of initialization vector and pre-ciphertext XOR, and SM2 elliptic curve encryption to protect the session key, enables the questionnaire data to form a double layer of protection of symmetric and asymmetric encryption during transmission. Even if the transmission link is intercepted, attackers cannot directly obtain the plaintext questionnaire content or session key.

[0085] In one alternative approach, the step of encapsulating the encrypted questionnaire data and the encrypted session key into a data packet includes: The ciphertext data output by the symmetric encryption is obtained as the encrypted questionnaire data, and the key ciphertext output by the asymmetric encryption is obtained as the encrypted session key.

[0086] According to the preset message format, the encrypted session key is used as the envelope header field, and the encrypted questionnaire data is used as the data payload field, which are combined into the data packet with a digital envelope structure.

[0087] The preset message format refers to a predefined data packet assembly format that specifies the position and length of the envelope header field and the data payload field in the data packet. For example, the predefined digital envelope message format specifies that the first 256 bytes of the data packet are the envelope header field used to store the encrypted session key, and the subsequent part is the data payload field used to store the encrypted questionnaire data.

[0088] The envelope header field refers to the area in the data packet used to store the encrypted session key. For example, the client fills the ciphertext of Employee A's session key (encrypted using SM2) into the first 256 bytes of the envelope header field of the data packet according to a preset message format. The data payload field refers to the area in the data packet used to store the encrypted questionnaire data. For example, the client fills the ciphertext of Employee A's questionnaire (encrypted using SM4) into the data payload field following the envelope header field of the data packet according to a preset message format.

[0089] The data packet does not contain the respondent's real identity identifier or physical characteristic data. A real identity identifier refers to identification information that can uniquely identify the respondent's true identity, including employee ID, name, and ID card number; for example, employee A's real identity identifier includes their employee ID E20260701, name "Employee A," and ID card number.

[0090] In the above-mentioned optional methods, the encrypted session key is further combined as the envelope header field and the encrypted questionnaire data as the data payload field to form a digital envelope structure. The real identity identifier and physical feature data are removed from the data packet, so that the transmitted message only carries encrypted content and has no traceable information, thus severing the association channel between identity and questionnaire data at the message structure level.

[0091] The technical solution of this embodiment requires only one set of underlying logic and front-end rendering engine. Through metadata decoupling and dynamic routing technology, it dynamically derives and configures matrix-style talent inventory questionnaires that are suitable for different levels and institutions. At the same time, it integrates the national cryptographic SM2 asymmetric encryption and SM4 symmetric encryption hybrid encryption algorithm, as well as the dual-level anonymization desensitization and reverse trace circuit breaker algorithm, to ensure the confidentiality and anti-tampering of data during transmission, and eliminate the risk of identity being reverse-deciphered from the physical, link and algorithm levels.

[0092] This embodiment constructs a closed-loop architecture consisting of metadata-driven, dynamic scene routing, adaptive rendering, and end-to-end national cryptographic encryption and double-level anonymization. At the metadata atomicity definition level, the questionnaire is decomposed into minimal atomic metadata, including question type metadata, indicator metadata, and entity metadata. Question type metadata includes single-choice, multiple-choice, multi-dimensional matrix, and compound fill-in-the-blank questions; indicator metadata includes growth potential indicators, problem-solving ability indicators, teamwork indicators, and professional ability indicators; and entity metadata includes an organizational structure list and a dynamic employee list. The scene-aware and dynamic routing engine interfaces with the enterprise's human resources master data system. When a respondent logs into the system, the routing engine uses the respondent's multi-dimensional identity vector... The system dynamically retrieves a preset configuration matrix and assembles the corresponding questionnaire metadata blocks as needed. These metadata blocks are organized in JSON Schema format. The front-end adaptive rendering engine reads the JSON configuration script generated by the dynamic routing and performs conditional rendering, supporting dynamic data injection for questions, options, and multi-level option boxes in compound fill-in-the-blank questions. The end-to-end national cryptographic transmission and dual-level desensitization security module integrates the national cryptographic SM2 asymmetric encryption and SM4 symmetric encryption suite, working in conjunction with a client-side edge anti-tracing circuit breaker, a transport layer salted hash component, and a server-side multi-dimensional aggregation anonymity verifier to ensure end-to-end confidentiality of data from the client's click to submit to the server's database.

[0093] In the end-to-end hybrid encryption transmission algorithm based on the Chinese national cryptographic standards SM2 and SM4, to ensure the confidentiality of questionnaire data during transmission and prevent network eavesdropping and man-in-the-middle tampering, a channel encryption mechanism based on the Chinese national cryptographic standards is built above the network layer. The server pre-generates a Chinese national cryptographic standard SM2 asymmetric key pair, including the public key. and private key When a respondent activates the questionnaire on the front end and prepares to submit it, the front end requests and obtains the SM2 public key for the current batch from the server. The front-end randomly generates a symmetric key for this session. The front-end encryption engine uses the SM4-CBC algorithm to encrypt questionnaire responses in detail. Encryption is performed to obtain encrypted ciphertext. The encryption process is represented as follows: in, This is the initialization vector. The frontend uses the server's SM2 public key. Session key for SM4 Perform asymmetric encryption to form a digital envelope. The encryption process is represented as follows: The front end will encrypt the ciphertext With digital envelopes The data is combined into a unified encrypted stream and sent to the server; upon receiving it, the server first uses the confidential SM2 private key... Unlock the digital envelope to recover the session key Then use the session key Decrypting encrypted ciphertext The questionnaire details are restored. Throughout the entire transmission process, no plaintext questionnaire details or session keys appear on the link, achieving absolute confidentiality from end to end.

[0094] In the dual-level anonymization and reverse trace circuit breaker algorithm, under the premise of ensuring channel confidentiality through national cryptographic algorithms, a two-stage anonymization process is implemented to achieve dual-level anonymization and reverse trace circuit breaker. The first stage is client-side edge anonymization and identification circuit breaker: when the respondent clicks submit, the client triggers the edge interception circuit breaker mechanism, immediately erasing and discarding physical feature data from local memory. Physical feature data includes the user's real IP address and device MAC address; the respondent's unique employee ID is also removed. With this questionnaire batch number Combined, a random salt value is introduced into the system. Perform an irreversible one-way hash calculation to generate a unique anonymous credential. The generation process is represented as follows: Anonymous credentials are linked to questionnaire details, completely blocking real identities before network transmission. The server can only identify that the answer record belongs to the same respondent through the anonymous credentials, but cannot deduce the respondent's real employee ID from the anonymous credentials. The second stage involves server-side multi-dimensional aggregation and reverse traceability circuit breaking: the server uses an asynchronous dual-channel write method, with the first channel recording only the anonymous credentials. The first channel is used to mark that the user has completed the quiz to prevent duplicate voting; the second channel only records the questionnaire index scores and the list of recommended users. The server-side statistics engine has a built-in K-anonymity determination mechanism, which determines the total number of samples within a certain statistical slice combination. Less than the preset anonymity threshold When the total number of samples reaches a certain threshold, the circuit breaker will be automatically triggered, refusing to display detailed data and forcing upward dimensional aggregation. Greater than or equal to the preset anonymity threshold At this time, the aggregated statistical results of the statistical slice are allowed to be displayed, but no information that can identify an individual is still displayed. At the algorithm level, this completely cuts off the path for administrators to trace the identity of respondents through intersection analysis.

[0095] In another embodiment of the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention, the following steps are included: S10. Obtain the multi-dimensional identity vector of the respondent. The multi-dimensional identity vector includes hierarchical information, organizational level information, and business line information. The business line information can be any one of the following: auto insurance underwriting line, claims investigation line, or actuarial line. In the annual talent review scenario in the auto insurance field, respondents in different business lines correspond to different sets of evaluation dimensions. The evaluation dimensions for the auto insurance underwriting line include underwriting accuracy indicators and risk identification capability indicators. The evaluation dimensions for the claims investigation line include on-site investigation timeliness indicators and loss assessment accuracy indicators. The evaluation dimensions for the actuarial line include pricing model accuracy indicators and reinsurance scheme design capability indicators.

[0096] S20. Based on the multidimensional identity vector, match the corresponding target questionnaire metadata block from the metadata configuration table. The target questionnaire metadata block contains question type metadata, indicator metadata, and entity metadata reference fields. The indicator metadata is retrieved from the corresponding evaluation dimension set based on the business line information. The entity metadata reference field points to the storage location of the dynamic personnel list that matches the organization level information and business line information. Assemble the question type metadata, indicator metadata, and dynamic personnel list into a questionnaire configuration script according to the preset template, and inject the dynamic personnel list into the option data source field of the questionnaire configuration script.

[0097] S30. Render the questionnaire page based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, execute a physical circuit breaker operation locally to clear the physical feature data and generate an anonymous credential based on the respondent's employee number and the current questionnaire batch number. The physical circuit breaker operation is achieved by writing random overwrite data on the client to overwrite the original physical feature data storage area and then releasing the storage area.

[0098] S40. The questionnaire data is symmetrically encrypted using a session key, and the session key is asymmetrically encrypted using the server's public key. The encrypted questionnaire data and the encrypted session key are encapsulated into a data packet and sent to the server. The symmetric encryption uses the SM4 block cipher link mode algorithm, and the asymmetric encryption uses the SM2 elliptic curve encryption algorithm.

[0099] S50. Receive the anonymization storage confirmation information returned by the server. The anonymization storage confirmation information indicates the state of separate storage of the anonymized credentials and the questionnaire data. The server uses an asynchronous dual-channel write method to perform separate storage. The first channel records the anonymized credentials and the second channel records the questionnaire data.

[0100] S60. In response to a statistical request for submitted questionnaire data, obtain the number of samples corresponding to the statistical slice. The statistical slice is formed by the cross combination of institutional level information and business line information. When the number of samples is less than the preset anonymity threshold, trigger the algorithm circuit breaker, refuse to display the detailed data of the statistical slice, and return the aggregated dimension data after forced upward aggregation to the next higher level institutional level to the requester.

[0101] This invention obtains the multidimensional identity vector of respondents and retrieves indicator metadata from the corresponding evaluation dimension set based on business line information. This allows respondents from different business areas, such as auto insurance underwriting, claims investigation, and actuarial departments, to receive personalized questionnaires within their respective professional fields. This avoids the repetitive work of developing and maintaining each questionnaire separately and reduces configuration costs during organizational restructuring. Furthermore, it employs a double-layer encryption protection system—combining the SM4 block cipher linking mode algorithm and the SM2 elliptic curve cryptography algorithm—by writing random overwrite data to cover the original physical feature data storage area and then releasing the storage area at the client submission time, along with asynchronous dual-channel encryption on the server side to transfer anonymous credentials and questionnaire data. According to the separate storage, IP addresses and device fingerprints are physically erased before transmission, questionnaire data and session keys exist in encrypted form in the link, and anonymous credentials and scoring data are isolated from each other, eliminating the possibility of reverse tracing the identity of respondents through device fingerprints and inferring individual scores through intersection analysis; by determining the sample size of statistical slices formed by the cross combination of institutional-level information and business line information, the algorithm is triggered to circuit break and return the aggregated summary data when the sample size is insufficient, ensuring that individual scores are not exposed in small sample scenarios. This provides a questionnaire collection and statistical analysis solution for talent inventory in the auto insurance field that can accurately identify professional backbones while fully protecting the privacy of evaluators.

[0102] Figure 2 This diagram illustrates the structure of an embodiment of a metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 provided by the present invention. Figure 2 As shown, the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 includes: Configuration module 201 is used to match the corresponding target questionnaire metadata block from the metadata configuration table based on the multidimensional identity vector of the respondent, and generate the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block; The generation module 202 is used to render the questionnaire page based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, a physical circuit breaker operation is performed locally to clear the physical feature data and generate an anonymous credential based on the respondent's employee number and the current questionnaire batch number. The encapsulation module 203 is used to symmetrically encrypt the questionnaire data using a session key, asymmetrically encrypt the session key using a server public key, encapsulate the encrypted questionnaire data and the encrypted session key into a data packet, and send the data packet to the server. The receiving module 204 is used to receive the anonymization storage confirmation information returned by the server, wherein the anonymization storage confirmation information is used to characterize the state of the anonymization credential being stored separately from the questionnaire data; The return module 205 is used to respond to a statistical request for submitted questionnaire data, obtain the number of samples corresponding to the statistical slice, and return aggregated dimension data to the requester when the number of samples is less than a preset anonymity threshold.

[0103] In an alternative embodiment, the configuration module 201 is specifically used for: Using the multidimensional identity vector as an index, the scenario routing matrix in the metadata configuration table is traversed to query the preset configuration entries that match the values ​​of each dimension in the multidimensional identity vector. The metadata blocks pointed to by the preset configuration entries are combined to determine the target questionnaire metadata block. Each configuration entry in the scenario routing matrix is ​​associated with a set of hierarchical threshold ranges, organizational level identifiers, and business line identifiers.

[0104] In an alternative embodiment, the configuration module 201 is specifically used for: Parse the question type metadata, indicator metadata, and entity metadata reference fields in the target questionnaire metadata block; Based on the organization level information in the multidimensional identity vector, retrieve the dynamic personnel list corresponding to the organization of the respondent from the entity metadata; The question type metadata, the indicator metadata, and the dynamic personnel list are assembled into the questionnaire configuration script according to a preset JSONSchema template, and the dynamic personnel list is injected into the option data source field of the questionnaire configuration script.

[0105] In an alternative embodiment, the generation module 202 is specifically used for: The cache address of the physical feature data stored in local memory is scanned by the edge interception fuse; Write random overwrite data to the storage area corresponding to the cache address to overwrite the original physical feature data, and release the storage area after the overwrite is completed; Send a memory reclamation confirmation request to the operating system of the client device, and obtain a confirmation signal from the operating system that the storage area has been reclaimed.

[0106] In an alternative embodiment, the generation module 202 is specifically used for: The employee ID and the current questionnaire batch number are concatenated in binary to obtain a concatenated sequence. A salt value sequence randomly generated by the server is obtained. The concatenated sequence and the salt value sequence are combined and then input into a hash function. The hash value output by the hash function is used as the anonymity credential.

[0107] In an alternative embodiment, the encapsulation module 203 is specifically used for: The client randomly generates the session key locally and obtains the server's public key from the server. The questionnaire data is divided into multiple data groups according to a preset group length. An initialization vector is obtained and used as the first pre-ciphertext. For each data group, the data group and the pre-ciphertext are XORed and then symmetrically encrypted using the SM4 encryption function. The corresponding group ciphertext is output and used as the pre-ciphertext for the next data group. After all the data groups are encrypted, all the group ciphertexts are combined in sequence to form the encrypted questionnaire data. The session key is input into the SM2 encryption function, and the session key is encrypted using the server public key to generate the encrypted session key.

[0108] In an alternative embodiment, the encapsulation module 203 is specifically used for: The ciphertext data output by the symmetric encryption is obtained as the encrypted questionnaire data, and the key ciphertext output by the asymmetric encryption is obtained as the encrypted session key. According to the preset message format, the encrypted session key is used as the envelope header field, and the encrypted questionnaire data is used as the data payload field, which are combined into the data packet with the digital envelope structure. The data packet does not contain the respondent's real identity identifier or physical characteristic data.

[0109] It should be noted that the beneficial effects of the metadata-driven questionnaire dynamic configuration and two-level anonymization desensitization system 200 provided in the above embodiments are the same as those of the metadata-driven questionnaire dynamic configuration and two-level anonymization desensitization method described above, and will not be repeated here. Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, and will not be repeated here.

[0110] The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 of the present invention can be a computer program (including program code) running on a computer device. For example, the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 of the present invention is an application software that can be used to execute the corresponding steps in the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention.

[0111] In some embodiments, the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 of the present invention can be implemented in a combination of hardware and software. As an example, the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization system 200 of the present invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method of the present invention. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0112] The modules described in the embodiments of this invention can be implemented in software or hardware. The names of the modules are not, in some cases, limiting the scope of the module itself.

[0113] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization methods. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method shown in any embodiment of the present invention by calling the computer program.

[0114] In one alternative embodiment, an electronic device is provided, such as Figure 3 As shown, Figure 3 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0115] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0116] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0117] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0118] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0119] Among them, electronic devices can also be terminal devices. A terminal device can be any terminal device that can install applications and access web pages through applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0120] It should be noted that, Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0121] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization methods.

[0122] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0123] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method.

[0124] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0125] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0126] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0127] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0128] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0129] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0130] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0131] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A metadata-driven method for dynamic questionnaire configuration and two-stage anonymization and desensitization, characterized in that, include: Based on the respondent's multidimensional identity vector, the corresponding target questionnaire metadata block is matched from the metadata configuration table, and the questionnaire configuration script corresponding to the respondent is generated based on the target questionnaire metadata block. The questionnaire page is rendered based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, a physical circuit breaker operation is performed locally to clear the physical feature data and generate an anonymous credential based on the respondent's employee number and the current questionnaire batch number. The questionnaire data is symmetrically encrypted using a session key, and the session key is asymmetrically encrypted using a server public key. The encrypted questionnaire data and the encrypted session key are then encapsulated into a data packet, which is then sent to the server. Receive the anonymization storage confirmation information returned by the server, the anonymization storage confirmation information being used to characterize the state of the anonymization credential being stored separately from the questionnaire data; In response to a statistical request for submitted questionnaire data, the system obtains the number of samples corresponding to the statistical slice. When the number of samples is less than a preset anonymity threshold, the system returns aggregated dimension data to the requester.

2. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 1, characterized in that, The steps for matching the corresponding target questionnaire metadata block from the metadata configuration table based on the respondent's multidimensional identity vector include: Using the multidimensional identity vector as an index, the scenario routing matrix in the metadata configuration table is traversed to query the preset configuration entries that match the values ​​of each dimension in the multidimensional identity vector. The metadata blocks pointed to by the preset configuration entries are combined to determine the target questionnaire metadata block. Each configuration entry in the scenario routing matrix is ​​associated with a set of hierarchical threshold ranges, organizational level identifiers, and business line identifiers.

3. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 2, characterized in that, The steps of generating the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block include: Parse the question type metadata, indicator metadata, and entity metadata reference fields in the target questionnaire metadata block; Based on the organization level information in the multidimensional identity vector, retrieve the dynamic personnel list corresponding to the organization of the respondent from the entity metadata; The question type metadata, the indicator metadata, and the dynamic personnel list are assembled into the questionnaire configuration script according to a preset JSON Schema template, and the dynamic personnel list is injected into the option data source field of the questionnaire configuration script.

4. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 1, characterized in that, The steps for performing a physical circuit breaker operation locally and clearing physical characteristic data include: The cache address of the physical feature data stored in local memory is scanned by the edge interception fuse; Write random overwrite data to the storage area corresponding to the cache address to overwrite the original physical feature data, and release the storage area after the overwrite is completed; Send a memory reclamation confirmation request to the operating system of the client device, and obtain a confirmation signal from the operating system that the storage area has been reclaimed.

5. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 4, characterized in that, The steps for generating anonymous credentials based on the respondent's employee ID and the current questionnaire batch number include: The employee ID and the current questionnaire batch number are concatenated in binary to obtain a concatenated sequence. A salt value sequence randomly generated by the server is obtained. The concatenated sequence and the salt value sequence are combined and then input into a hash function. The hash value output by the hash function is used as the anonymity credential.

6. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 5, characterized in that, The steps of symmetric encryption of the questionnaire data using a session key and asymmetric encryption of the session key using a server public key include: The client randomly generates the session key locally and obtains the server's public key from the server. The questionnaire data is divided into multiple data groups according to a preset group length. An initialization vector is obtained and used as the first pre-ciphertext. For each data group, the data group and the pre-ciphertext are XORed and then symmetrically encrypted using the SM4 encryption function. The corresponding group ciphertext is output and used as the pre-ciphertext for the next data group. After all the data groups are encrypted, all the group ciphertexts are combined in sequence to form the encrypted questionnaire data. The session key is input into the SM2 encryption function, and the session key is encrypted using the server public key to generate the encrypted session key.

7. The metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method according to claim 6, characterized in that, The step of encapsulating the encrypted questionnaire data and the encrypted session key into a data packet includes: The ciphertext data output by the symmetric encryption is obtained as the encrypted questionnaire data, and the key ciphertext output by the asymmetric encryption is obtained as the encrypted session key. According to the preset message format, the encrypted session key is used as the envelope header field, and the encrypted questionnaire data is used as the data payload field, which are combined into the data packet with the digital envelope structure. The data packet does not contain the respondent's real identity identifier or physical characteristic data.

8. A metadata-driven questionnaire dynamic configuration and two-stage anonymity desensitization system, characterized in that, include: The configuration module is used to match the corresponding target questionnaire metadata block from the metadata configuration table based on the respondent's multidimensional identity vector, and generate the questionnaire configuration script corresponding to the respondent based on the target questionnaire metadata block; The generation module is used to render the questionnaire page based on the questionnaire configuration script. When the questionnaire data filled in by the respondent on the questionnaire page is obtained, a physical circuit breaker operation is performed locally to clear the physical feature data, and an anonymous credential is generated based on the respondent's employee number and the current questionnaire batch number. The encapsulation module is used to symmetrically encrypt the questionnaire data using a session key, asymmetrically encrypt the session key using a server public key, encapsulate the encrypted questionnaire data and the encrypted session key into a data packet, and send the data packet to the server. The receiving module is used to receive the anonymized storage confirmation information returned by the server, wherein the anonymized storage confirmation information is used to characterize the state of the anonymized credentials being stored separately from the questionnaire data; The return module is used to respond to statistical requests for submitted questionnaire data, obtain the number of samples corresponding to the statistical slice, and return aggregated dimension data to the requester when the number of samples is less than a preset anonymity threshold.

9. An electronic device, characterized in that, The electronic device includes a processor coupled to a memory storing at least one computer program, which is loaded and executed by the processor to enable the electronic device to implement the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which, when executed by a processor, implements the metadata-driven questionnaire dynamic configuration and two-stage anonymization desensitization method as described in any one of claims 1 to 7.

Images