Project sensitive data grading desensitization method based on business secret algorithm and dynamic mask

Abstract

The application provides a project sensitive data grading desensitization method based on a business secret algorithm and a dynamic mask, relates to the technical field of project data security desensitization, and comprises the following operation steps: S1: multi-dimensional quantitative grading right confirmation and traceability binding of project sensitive data; S2: self-adaptive strength encryption preprocessing of the business secret SM4 algorithm based on graded data; S3: scenario-based dynamic mask self-adaptive replacement processing relying on the encryption strength; S4: multi-dimensional global desensitization data consistency closed loop verification and compliance output. The application can realize dynamic adaptation of the encryption strength to the data sensitive level and the scene leakage risk, automatically match high-strength encryption protection for high-sensitive and high-risk data, and adapt a light-weight encryption mode to low-sensitive and low-risk data, so that the application not only guarantees the underlying security protection strength of core sensitive data, but also avoids resource waste caused by over-encryption of low-risk data.

Description

Technical Field

[0001] This invention relates to the field of project data security desensitization technology, and more specifically, to a hierarchical desensitization method for sensitive project data based on commercial cryptographic algorithms and dynamic masks. Background Technology

[0002] In the field of security protection for core financial data and core personnel data of projects, existing de-identification protection systems generally suffer from the problem of separation between commercial encryption technology and mask de-identification technology. The two types of technologies operate independently without a linkage and coupling mechanism, and cannot form a collaborative protection capability.

[0003] Currently, mainstream commercial encryption solutions all adopt static encryption modes with fixed parameters and fixed iteration strengths. This makes it impossible to adapt the protection strength based on the sensitivity and risk level of the data itself and the exposure risks in different business scenarios, resulting in extremely poor protection flexibility. Meanwhile, traditional masking and de-identification uses uniform and fixed static rules, with fixed mask coverage and de-identification modes, failing to adapt to the security and usage requirements of three different business scenarios: interface returns, log storage, and front-end display. Furthermore, existing technologies lack a quantitative correlation logic between encryption strength and de-identification rules, easily leading to the dual problems of over-de-identification affecting normal business interactions and insufficient de-identification causing data leakage. Moreover, the protection rules for multiple scenarios are chaotic and lack a unified standard, making it impossible to achieve end-to-end closed-loop verification. Overall, the data protection effect is singular, lacking adaptive and collaborative protection capabilities. Summary of the Invention

[0004] The purpose of this invention is to address the current technology's lack of a standardized and quantifiable data grading and traceability mechanism, the absence of unified pre-judgment criteria for desensitization and encryption-related parameters, and the existence of subjective human judgment and vague technical rules.

[0005] To achieve the above-mentioned objectives and improve the aforementioned problems, this invention provides a hierarchical desensitization method for sensitive project data based on commercial cryptographic algorithms and dynamic masks, comprising the following steps: S1: Multi-dimensional quantitative classification, ownership confirmation, and source binding of sensitive project data. The core financial data and core personnel data of the project are defined in the entire domain. The confidentiality level is quantitatively classified based on the dual dimensions of the degree of harm caused by data leakage and the risk of exposure in business scenarios. A unique source identifier and scenario attribute label are bound to each piece of sensitive data to build a desensitized basic dataset. S2: Adaptive strength encryption preprocessing of the SM4 commercial cryptographic algorithm based on hierarchical data. The number of SM4 encryption iterations is adaptively calculated using the commercial cryptographic encryption strength calculation formula. Based on the number of iterations, the original sensitive data is subjected to hierarchical iterative encryption, generating encryption verification and traceability information. The commercial cryptographic encryption strength calculation formula is: ; Among them This refers to the number of data encryption iterations per cycle using the commercial SM4 algorithm. The weighting coefficients for security levels are fixed. This refers to the security level quantization value for sensitive data. Adjust fixed coefficients for the scene; The confidentiality level quantification value for risks exposed in business scenarios; S3: Based on the scenario-based dynamic mask adaptive replacement processing of encryption strength, the sensitive field mask coverage ratio is solved by the dynamic mask coverage calculation formula. Combined with the fault tolerance coefficients of three business scenarios, differentiated dynamic mask replacement is performed on the data of three scenarios: interface return, log storage, and front-end display to complete the surface compliance desensitization display. The formula for calculating dynamic mask coverage is: ; Among them The mask coverage ratio for core sensitive fields of sensitive data; This represents the percentage of publicly disclosed fields. The scene desensitization and fault tolerance coefficient; S4: Multi-dimensional, full-domain de-identified data consistency closed-loop verification and compliant output. For the data processed by S1-S3, dual verification is carried out, including cross-scenario rule consistency verification and encryption mask linkage matching verification.

[0006] As a preferred technical solution of this application, step S1 specifically includes: S101: Accurately define the correspondence between sensitive data and business scenarios, conduct a comprehensive review of project business system data, and classify two categories of core sensitive data. S102: Complete the classification of sensitive data security level using dual-dimensional quantization and establish a dual-dimensional security level quantization judgment standard; S103: Generate a structured and unique data traceability identifier. For each piece of sensitive data that has completed the security classification, the three types of attributes, namely data type label, security level label, and business scenario binding label, are structured and bound and stored to generate a unique and non-repeatable data traceability ID and build a standardized desensitized basic database.

[0007] As a preferred technical solution of this application, in S101, the two categories of core sensitive data are: The project's core financial data, including core operating data; Data on key project personnel, including data on key project personnel.

[0008] As a preferred technical solution of this application, in S102, the dual-dimensional density level quantification judgment standard is as follows: The first dimension is the degree of harm caused by the leakage of the data itself; The second dimension is the data exposure risk level for the corresponding business scenario; The dual-dimensional security classification standard divides all target sensitive data into three fixed security levels. The first level, core sensitive data, is core data that would cause significant economic losses to the project or leakage of personnel information if leaked. The second level, important sensitive data, is important data that would cause partial business risks to the project or partial leakage of personnel information if leaked. The third level, general sensitive data, is routine sensitive data that would only cause minor business impacts and no major security risks if leaked.

[0009] As a preferred technical solution of this application, step S2 specifically includes: S201: Unified parameter quantification assignment, based on the security classification standard of S1 and the data exposure risk level standard of business scenarios, to complete fixed quantification assignment: The first-level core sensitivity level is assigned a value of 3, the second-level important sensitivity level is assigned a value of 2, and the third-level general sensitivity level is assigned a value of 1. Risk quantification values ​​for business scenarios: 3 for API return scenarios, 2 for log storage scenarios, and 1 for front-end display scenarios; S202: Solve for the number of single encryption iterations of the SM4 algorithm using the commercial cryptographic encryption strength calculation formula; S203: Layered iterative encryption and traceability verification value generation, retrieving the domestic commercial cryptographic SM4 symmetric encryption algorithm, and calculating the... Using a unique iteration parameter, the original project's sensitive data undergoes layered and iterative encryption processing. After encryption, a unique encrypted verification value is generated based on the SM4 algorithm hash verification rules, and stored in conjunction with the data traceability ID.

[0010] As a preferred technical solution of this application, step S3 specifically includes: S301: Retrieve pre-standardized parameters based on traceability ID and count the field proportion. Based on the unique, non-repeatable traceability ID generated by S1, match and retrieve all pre-standardized parameters corresponding to the sensitive data. S302: Based on the solution obtained Differentiated desensitization processing is performed on business scenarios with quantified risk values ​​for the three types of business scenarios.

[0011] As a preferred technical solution of this application, step S301 specifically includes: Based on the security level quantification value of sensitive data, the security level quantification value of risks exposed in business scenarios, and Simultaneously, based on the structured data categories of the project's core financial data and core personnel data, the overall field structure of the original sensitive data is analyzed, distinguishing between the system's preset non-sensitive public fields and core sensitive fields, statistically analyzing the total number of fields and the number of non-sensitive public fields, and calculating the percentage of public fields. Public field percentage It is the ratio of the number of non-sensitive public fields to the total number of fields in the data.

[0012] As a preferred technical solution of this application, the differentiated desensitization process in step S302 includes: The API response uses a precise partial mask to retain the public fields necessary for business interaction based on coverage, ensuring normal business transmission and interaction. In log storage scenarios, high-coverage deep masking is used to hide sensitive information and ensure the long-term security of log storage. The front-end display uses a visual compliance mask, which meets the requirements for de-identification and security while maintaining the integrity of the interface display, and finally completes the dynamic mask replacement of sensitive data in all scenarios.

[0013] As a preferred technical solution of this application, step S4 specifically includes: S401: Cross-scenario desensitization rule consistency verification. Based on the data security classification standard, compare the desensitization parameters and protection levels of sensitive data with the same traceability ID in three business scenarios, verify the consistency of the basic protection standards of data with the same security level, and investigate and correct abnormal issues such as imbalance of protection levels and inconsistent rules for the same data in multiple scenarios. S402: Encryption and mask linkage matching verification, relying on... and Establish a linkage matching and verification mechanism to verify whether highly sensitive data with high-iteration encryption matches high-coverage masks, and whether lightweight encrypted data in low-risk scenarios matches low-coverage and appropriate desensitization. S403: Compliance Data Solidification and Full-Domain Output. For de-identified data that has passed both verifications, solidify all-dimensional attribute information to form compliance de-identified data results, which are simultaneously output to the interface response port, system log storage port, and front-end page display port, ultimately completing the entire closed-loop processing flow of sensitive project data from classification, encryption, de-identification to verification output.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: In the scheme of this application: 1. Through a standardized process of precise definition of data scope, dual-dimensional security level quantification and classification, and unique traceability identification, the attribute tags, security level, and scenario affiliation of all sensitive data are fully traceable, providing a unified and unique set of pre-parameters for the subsequent encryption, desensitization, and verification processes, which greatly improves the standardization and practicality of data desensitization technology. 2. This invention achieves adaptive dynamic adjustment of commercial encryption technology. Based on the results of prior data classification, it links data security level with scenario risk through a dedicated quantitative formula to realize dynamic adaptation of encryption strength according to data sensitivity level and scenario leakage risk. High-sensitivity and high-risk data are automatically matched with high-strength encryption protection, while low-sensitivity and low-risk data are adapted to lightweight encryption mode. This not only ensures the underlying security protection strength of core sensitive data, but also avoids the waste of resources caused by excessive encryption of low-risk data. 3. By using a dedicated mask coverage calculation formula and encryption iteration strength as the core linkage parameter of the de-identification rules, the underlying encryption protection strength and the surface de-identification coverage are positively matched, allowing the underlying encryption and solidification of data and the surface compliance de-identification to form a deep synergy. Single encryption can only achieve storage protection, and single de-identification can only achieve surface display protection. After the two are linked, they can cover the entire link of data transmission, storage, and display security protection. 4. Through a dual verification mechanism of cross-scenario rule consistency verification and encryption mask linkage matching verification, a unified de-identification protection standard is established for multiple business scenarios. This precisely avoids the dual technical problems of excessive de-identification affecting business interactions and insufficient de-identification causing data leakage. It achieves closed-loop management of data throughout the entire process, from hierarchical ownership confirmation, underlying encryption, dynamic de-identification to compliant output. The multi-scenario differentiated de-identification mode can accurately adapt to the differentiated needs of interfaces, logs, and front-end displays, maximizing the preservation of business-usable attributes while ensuring data security and compliance, thus balancing data security and business practicality. Attached Figure Description

[0015] Figure 1 The flowchart shows the project sensitive data hierarchical desensitization method based on commercial cryptography algorithm and dynamic masking provided in this application. Detailed Implementation

[0016] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0018] It should be noted that, unless otherwise specified, the embodiments and features and technical solutions in the present invention can be combined with each other.

[0019] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0020] Please refer to Figure 1 A graded desensitization method for sensitive project data based on commercial cryptographic algorithms and dynamic masking includes the following steps: S1: Multi-dimensional quantitative classification, ownership confirmation, and source binding of sensitive project data. The core financial data and core personnel data of the project are defined in the entire domain. The confidentiality level is quantitatively classified based on the dual dimensions of the degree of harm caused by data leakage and the risk of exposure in business scenarios. A unique source identifier and scenario attribute label are bound to each piece of sensitive data to build a desensitized basic dataset. S2: Adaptive strength encryption preprocessing of the SM4 commercial cryptographic algorithm based on hierarchical data. Relying on the security level quantification values ​​of sensitive data and the security level quantification values ​​of risks exposed in business scenarios, the SM4 algorithm encryption iteration number is adaptively calculated using the commercial cryptographic encryption strength calculation formula. Based on the iteration number, the original sensitive data is subjected to hierarchical iterative encryption, generating encryption verification and traceability information. The commercial cryptographic encryption strength calculation formula is: ; Among them This represents the number of data encryption iterations in a single session using the SM4 commercial encryption algorithm, expressed in times. A higher value indicates stronger encryption protection. The system uses a fixed coefficient of 1.2 to weight the sensitivity and hazard of the data itself. This refers to the security level quantization value for sensitive data. A fixed coefficient is set for scenario correction, with a system value of 0.8, to be used for weighted quantification of leakage risk weights in different business scenarios; This formula quantifies the security level of risks exposed in business scenarios. As the data sensitivity level increases and the risk of leakage in the scenario rises, the number of encryption iterations increases accordingly, achieving precise and adaptive adaptation of encryption strength. S3: Based on the scenario-based dynamic mask adaptive replacement processing of encryption strength, the sensitive field mask coverage ratio is solved by the dynamic mask coverage calculation formula. Combined with the fault tolerance coefficients of three business scenarios, differentiated dynamic mask replacement is performed on the data of three scenarios: interface return, log storage, and front-end display to complete the surface compliance desensitization display. The formula for calculating dynamic mask coverage is: ; Among them This represents the mask coverage ratio of core sensitive fields in sensitive data. The value range is from 0 to 1. The larger the value, the wider the desensitization coverage and the higher the desensitization strength. This step represents the percentage of publicly disclosed fields obtained from the statistical analysis of the preceding structured data. The scenario-based desensitization tolerance coefficient is a fixed value for each scenario: 0.9 for the interface return scenario, 0.7 for the log storage scenario, and 0.5 for the front-end display scenario. This scenario-based tolerance coefficient corresponds one-to-one with the three business scenarios bound in the first step. This formula ensures that the higher the underlying encryption strength of S2 output, the wider the coverage of the surface mask desensitization, forming a positive linkage mechanism of high-strength encryption matching high-level desensitization. S4: Multi-dimensional, full-domain de-identification data consistency closed-loop verification and compliant output. For the data processed by S1-S3, cross-scenario rule consistency verification and encryption mask linkage matching verification are carried out for dual verification. Abnormal data with de-identification rule conflicts and protection level mismatch are corrected, the compliant de-identification results are solidified and synchronously output to various business ports to achieve a closed loop of de-identification technology throughout the entire process.

[0021] Furthermore, S1 specifically includes: S101: Accurately define the correspondence between sensitive data and business scenarios, conduct a comprehensive review of project business system data, and classify two categories of core sensitive data. S102: Complete the classification of sensitive data security level using dual-dimensional quantization and establish a dual-dimensional security level quantization judgment standard; S103: Generate a structured and unique data traceability identifier. For each piece of sensitive data that has completed the security classification, the three types of attributes, namely data type label, security level label, and business scenario binding label, are structured and bound and stored to generate a unique and non-repeatable data traceability ID and build a standardized desensitized basic database.

[0022] Furthermore, in S101, the two categories of core sensitive data are: The project's core financial data includes key operational data such as project budget amount, amount received, cost accounting data, and tax settlement data; The core personnel data of the project includes core personnel data such as salary, identity information, job permission information, and confidential performance information. It is also bound to three types of fixed business output scenarios, namely the interface data return scenario from the system backend to the front-end terminal, the log storage scenario of system operation status and operation records, and the visualization display scenario of the front-end page of the user terminal.

[0023] Furthermore, in S102, the dual-dimensional density level quantification judgment criteria are as follows: The first dimension is the degree of harm caused by the leakage of the data itself; The second dimension is the data exposure risk level for the corresponding business scenario; The dual-dimensional confidentiality classification standard divides all target sensitive data into three fixed confidentiality levels. The classification standard is unified and unique, with no ambiguous judgment range. The first level, core sensitive data, is core data that would cause significant economic losses to the project or leakage of personnel information if leaked. The second level, important sensitive data, is important data that would cause partial business risks to the project or partial leakage of personnel information if leaked. The third level, general sensitive data, is routine sensitive data that would only cause minor business impacts and no major security risks if leaked. The confidentiality classification label initialization and entry are completed for all data.

[0024] Furthermore, S2 specifically includes: S201: Unified parameter quantification assignment. Based on the security classification standard of S1 and the data exposure risk level standard of business scenarios, fixed quantification assignment is completed. The parameters are consistent and unchanged throughout the process. Data security classification quantification value: The first-level core sensitivity level is assigned a value of 3, the second-level important sensitivity level is assigned a value of 2, and the third-level general sensitivity level is assigned a value of 1. Business scenario risk quantification values: 3 for interface return scenarios, 2 for log storage scenarios, and 1 for front-end display scenarios. All quantification values ​​are fixed constants of the system and cannot be customized throughout the process to ensure the standardization of encryption parameters. S202: Solve for the number of single encryption iterations of the SM4 algorithm using the commercial cryptographic encryption strength calculation formula; S203: Layered iterative encryption and traceability verification value generation, retrieving the domestic commercial cryptographic SM4 symmetric encryption algorithm, and calculating the... Using a unique iteration parameter, the original project's sensitive data undergoes layered and iterative encryption processing to avoid the deficiency of insufficient protection strength in a single encryption. After encryption is completed, a unique encrypted verification value is generated for the corresponding data based on the SM4 algorithm hash verification rules, and then bound and stored with the data traceability ID.

[0025] Furthermore, S3 specifically includes: S301: Retrieve pre-standardized parameters based on traceability ID and count the field proportion. Based on the unique, non-repeatable traceability ID generated by S1, match and retrieve all pre-standardized parameters corresponding to the sensitive data. S302: Based on the solution obtained Differentiated desensitization processing is performed on business scenarios with quantified risk values ​​for the three types of business scenarios.

[0026] Furthermore, S301 specifically includes: Based on the security level quantification value of sensitive data, the security level quantification value of risks exposed in business scenarios, and Simultaneously, based on the structured data categories of the project's core financial data and core personnel data, the overall field structure of the original sensitive data is analyzed, distinguishing between the system's preset non-sensitive public fields and core sensitive fields, statistically analyzing the total number of fields and the number of non-sensitive public fields, and calculating the percentage of public fields. Public field percentage It is the ratio of the number of non-sensitive public fields to the total number of fields in the data.

[0027] Furthermore, in S302, the differentiated desensitization process includes: The API response uses a precise partial mask to retain the public fields necessary for business interaction based on coverage, ensuring normal business transmission and interaction. In log storage scenarios, high-coverage deep masking is used to hide sensitive information and ensure the long-term security of log storage. The front-end display uses a visual compliance mask, which meets the requirements for de-identification and security while maintaining the integrity of the interface display, and finally completes the dynamic mask replacement of sensitive data in all scenarios.

[0028] Furthermore, S4 specifically includes: S401: Cross-scenario desensitization rule consistency verification. Based on the data security classification standard, compare the desensitization parameters and protection levels of sensitive data with the same traceability ID in three business scenarios, verify the consistency of the basic protection standards of data with the same security level, and investigate and correct abnormal issues such as imbalance of protection levels and inconsistent rules for the same data in multiple scenarios. S402: Encryption and mask linkage matching verification, relying on... and Establish a linkage matching and verification mechanism to verify whether highly sensitive data with high-iteration encryption matches high-coverage masks and whether lightweight encrypted data in low-risk scenarios matches low-coverage appropriate desensitization. This accurately avoids the dual technical defects of excessive desensitization affecting business use and insufficient desensitization leading to data leakage, ensuring the synergistic protection effect of encryption and desensitization. S403: Compliance Data Solidification and Full-Domain Output. For de-identified data that has passed both verifications, solidify its encryption parameters, mask parameters, hierarchical labels, and other full-dimensional attribute information to form compliance de-identified data results. These results are then simultaneously output to the interface response port, system log storage port, and front-end page display port, ultimately completing the entire closed-loop processing flow of sensitive project data from hierarchical classification, encryption, de-identification to verification output.

[0029] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection, an electrical connection, or a connection that allows communication between them; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise explicitly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0030] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A hierarchical desensitization method for sensitive project data based on commercial cryptographic algorithms and dynamic masking, characterized in that, The following steps are included: S1: Multi-dimensional quantitative classification, ownership confirmation, and source binding of sensitive project data. The core financial data and core personnel data of the project are defined in the entire domain. The confidentiality level is quantitatively classified based on the dual dimensions of the degree of harm caused by data leakage and the risk of exposure in business scenarios. A unique source identifier and scenario attribute label are bound to each piece of sensitive data to build a desensitized basic dataset. S2: Adaptive strength encryption preprocessing of the SM4 commercial cryptographic algorithm based on hierarchical data. The number of SM4 encryption iterations is adaptively calculated using the commercial cryptographic encryption strength calculation formula. Based on the number of iterations, the original sensitive data is subjected to hierarchical iterative encryption, generating encryption verification and traceability information. The commercial cryptographic encryption strength calculation formula is: ； Among them This refers to the number of data encryption iterations per cycle using the commercial SM4 algorithm. The weighting coefficients for security levels are fixed. This refers to the security level quantization value for sensitive data. Adjust fixed coefficients for the scene; The confidentiality level quantification value for risks exposed in business scenarios; S3: Based on the scenario-based dynamic mask adaptive replacement processing of encryption strength, the sensitive field mask coverage ratio is solved by the dynamic mask coverage calculation formula. Combined with the fault tolerance coefficients of three business scenarios, differentiated dynamic mask replacement is performed on the data of three scenarios: interface return, log storage, and front-end display to complete the surface compliance desensitization display. The formula for calculating dynamic mask coverage is: ； Among them The mask coverage ratio for core sensitive fields of sensitive data; This represents the percentage of publicly disclosed fields. The scene desensitization and fault tolerance coefficient; S4: Multi-dimensional, full-domain de-identified data consistency closed-loop verification and compliant output. For the data processed by S1-S3, dual verification is carried out, including cross-scenario rule consistency verification and encryption mask linkage matching verification.

2. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 1, characterized in that, Specifically, S1 includes: S101: Accurately define the correspondence between sensitive data and business scenarios, conduct a comprehensive review of project business system data, and classify two categories of core sensitive data. S102: Complete the classification of sensitive data security level using dual-dimensional quantization and establish a dual-dimensional security level quantization judgment standard; S103: Generate a structured and unique data traceability identifier. For each piece of sensitive data that has completed the security classification, the three types of attributes, namely data type label, security level label, and business scenario binding label, are structured and bound and stored to generate a unique and non-repeatable data traceability ID and build a standardized desensitized basic database.

3. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 2, characterized in that, In S101, the two categories of core sensitive data are: The project's core financial data, including core operating data; Data on key project personnel, including data on key project personnel.

4. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 3, characterized in that, In S102, the dual-dimensional density level quantization determination criterion is as follows: The first dimension is the degree of harm caused by the leakage of the data itself; The second dimension is the data exposure risk level for the corresponding business scenario; The dual-dimensional security classification standard divides all target sensitive data into three fixed security levels. The first level, core sensitive data, is core data that would cause significant economic losses to the project or leakage of personnel information if leaked. The second level, important sensitive data, is important data that would cause partial business risks to the project or partial leakage of personnel information if leaked. The third level, general sensitive data, is routine sensitive data that would only cause minor business impacts and no major security risks if leaked.

5. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 4, characterized in that, Specifically, S2 includes: S201: Unified parameter quantification assignment, based on the security classification standard of S1 and the data exposure risk level standard of business scenarios, to complete fixed quantification assignment: The first-level core sensitivity level is assigned a value of 3, the second-level important sensitivity level is assigned a value of 2, and the third-level general sensitivity level is assigned a value of 1. Risk quantification values ​​for business scenarios: 3 for API return scenarios, 2 for log storage scenarios, and 1 for front-end display scenarios; S202: Solve for the number of single encryption iterations of the SM4 algorithm using the commercial cryptographic encryption strength calculation formula; S203: Layered iterative encryption and traceability verification value generation, retrieving the domestic commercial cryptographic SM4 symmetric encryption algorithm, and calculating the... Using a unique iteration parameter, the original project's sensitive data undergoes layered and iterative encryption processing. After encryption, a unique encrypted verification value is generated based on the SM4 algorithm hash verification rules, and stored in conjunction with the data traceability ID.

6. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 5, characterized in that, Specifically, S3 includes: S301: Retrieve pre-standardized parameters based on traceability ID and count the field proportion. Based on the unique, non-repeatable traceability ID generated by S1, match and retrieve all pre-standardized parameters corresponding to the sensitive data. S302: Based on the solution obtained Differentiated desensitization processing is performed on business scenarios with quantified risk values ​​for the three types of business scenarios.

7. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 6, characterized in that, Specifically, S301 includes: Based on the security level quantification value of sensitive data, the security level quantification value of risks exposed in business scenarios, and Simultaneously, based on the structured data categories of the project's core financial data and core personnel data, the overall field structure of the original sensitive data is analyzed, distinguishing between the system's preset non-sensitive public fields and core sensitive fields, statistically analyzing the total number of fields and the number of non-sensitive public fields, and calculating the percentage of public fields. Public field percentage It is the ratio of the number of non-sensitive public fields to the total number of fields in the data.

8. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 7, characterized in that, In step S302, the differentiated desensitization process includes: The API response uses a precise partial mask to retain the public fields necessary for business interaction based on coverage, ensuring normal business transmission and interaction. In log storage scenarios, high-coverage deep masking is used to hide sensitive information and ensure the long-term security of log storage. The front-end display uses a visual compliance mask, which meets the requirements for de-identification and security while maintaining the integrity of the interface display, and finally completes the dynamic mask replacement of sensitive data in all scenarios.

9. The hierarchical desensitization method for sensitive project data based on commercial cryptography algorithm and dynamic masking according to claim 8, characterized in that, Specifically, S4 includes: S401: Cross-scenario desensitization rule consistency verification. Based on the data security classification standard, compare the desensitization parameters and protection levels of sensitive data with the same traceability ID in three business scenarios, verify the consistency of the basic protection standards of data with the same security level, and investigate and correct abnormal issues such as imbalance of protection levels and inconsistent rules for the same data in multiple scenarios. S402: Encryption and mask linkage matching verification, relying on... and Establish a linkage matching and verification mechanism to verify whether highly sensitive data with high-iteration encryption matches high-coverage masks, and whether lightweight encrypted data in low-risk scenarios matches low-coverage and appropriate desensitization. S403: Compliance Data Solidification and Full-Domain Output. For de-identified data that has passed both verifications, solidify all-dimensional attribute information to form compliance de-identified data results, which are simultaneously output to the interface response port, system log storage port, and front-end page display port, ultimately completing the entire closed-loop processing flow of sensitive project data from classification, encryption, de-identification to verification output.

Images