Data de-sensitization and restoration method, apparatus, and electronic device

Abstract

The application provides a data desensitization and restoration method and device and electronic equipment, and belongs to the technical field of computer software. In the method, a desensitization replacement value is generated by combining a structure reservation template corresponding to a sensitive data category and a distinguishing sequence identifier, the type structure characteristics of the sensitive data are effectively reserved while the data availability is ensured, the entity is uniquely distinguished, and therefore, semantic confusion of the model in numerical reasoning and format checking is avoided. Meanwhile, the original request is converted into a desensitization request and sent to a target model, and after receiving complete response data, overall restoration is performed, thereby greatly reducing the risk of restoration failure or sensitive information leakage, and realizing high safety and high precision data desensitization and lossless restoration in a large model interaction scene.

Description

Technical Field

[0001] This invention relates to the field of computer software technology, and in particular to a data desensitization and restoration method, apparatus, and electronic device. Background Technology

[0002] With the widespread application of large language model technology, in order to prevent the leakage of sensitive data during interaction with it, it is usually necessary to de-identify the data before sending the request and restore it after receiving the response.

[0003] However, existing desensitization techniques have many drawbacks when applied to large language model scenarios: First, general replacement schemes often destroy the original type structure features of the data, affecting the model's numerical reasoning and format verification capabilities; Second, simple masking processing causes the model to be unable to distinguish multiple similar sensitive entities in the context, resulting in semantic confusion.

[0004] In summary, traditional desensitization techniques suffer from technical problems such as damaging data structure features and lacking entity differentiation when dealing with large-scale model interactions. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a data desensitization and restoration method, apparatus and electronic device to alleviate the technical problems of traditional desensitization technology in dealing with large model interactions, such as destroying data structure features and lacking entity distinguishability.

[0006] In a first aspect, the present invention provides a data desensitization and restoration method, comprising: Obtain the raw request to be processed, which contains target sensitive data; Based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category, determine the de-identification prefix; By combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier, a de-identified replacement value corresponding to the target sensitive data is generated, and a mapping relationship is established between the de-identified replacement value and the target sensitive data; Based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model; Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

[0007] Further, based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category, a de-identification prefix is ​​determined, including: If the matching rule is configured with a custom desensitization prefix, then the custom desensitization prefix will be used as the desensitization prefix; If the matching rule is not configured with a custom de-identification prefix, then the judgment is made based on the sensitive data category: When the sensitive data category is an unstructured category, the rule identifier of the matching rule is used as the desensitization prefix; When the sensitive data category is a structured category, the desensitization prefix is ​​inferred from the first matching sample of the target sensitive data.

[0008] Further, by combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier, a de-identified replacement value corresponding to the target sensitive data is generated, including: A grouping strategy is determined based on the sensitive data category, wherein structured categories are grouped according to the sensitive data category, and unstructured categories are grouped according to the rule identifier of the matching rule; Within the group to which the target sensitive data belongs, a monotonically increasing distinguishing sequence identifier is generated; The desensitized replacement value is generated based on the structure retention template, the desensitization prefix, and the distinguishing sequence identifier.

[0009] Further, based on the structure-preserving template, the desensitization prefix, and the distinguishing sequence identifier, the desensitization replacement value is generated, including: The distinguishing sequence identifier is converted into a fixed-length zero-padding number; The desensitization prefix is ​​concatenated with the zero-padding number to obtain the desensitization replacement value; The generation of the desensitized replacement value follows the structure preservation template so that the overall length and character set of the desensitized replacement value are consistent with the original form of the target sensitive data.

[0010] Further, based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model, including: In response to the original request being a chunked streaming request and the mapping relationship being non-empty, the original request is converted into a non-streaming de-identified request based on the de-identified replacement value and sent to the target model; Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content, including: Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and convert the restored complete content into a chunked streaming format for output.

[0011] Further, based on the de-identified replacement value, the original request is converted into a non-streaming de-identified request and sent to the target model, including: Intercept the original request; The streaming identifier in the original request is modified to a non-streaming identifier, and the target sensitive data in it is replaced with the desensitized replacement value to obtain the non-streaming desensitized request. Send the non-streaming desensitization request to the target model; Based on the mapping relationship, the complete response data is restored as a whole, and the restored complete content is converted into a chunked streaming format for output, including: Serialize the complete response data into a string; Traverse the mapping relationship, restore the desensitized replacement value to the target sensitive data in the string, and obtain the restored complete content; The restored complete content is encapsulated into data blocks conforming to the chunked streaming transport protocol format; An end marker is appended to the data block, and the data is output to the client.

[0012] Furthermore, the method also includes: The mapping relationship will be stored only in the memory context of the current request processing cycle; After the restored complete content is output, the mapping relationship in the memory context is immediately cleared to prevent the persistent storage or cross-request sharing of the mapping relationship.

[0013] Further, based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model, including: In response to the original request being a non-streaming request, the target sensitive data in the original request is replaced with the corresponding de-identified replacement value to obtain a de-identified request, which is then sent to the target model. After receiving the response data returned by the target model, if the mapping relationship is not empty, a restoration operation is performed on the response data based on the mapping relationship. The method further includes: If the mapping relationship is empty, the original request is directly passed through to the target model, and the response data returned by the target model is directly output.

[0014] Secondly, the present invention also provides a data desensitization and restoration apparatus, comprising: The acquisition unit is used to acquire the original request to be processed, wherein the original request contains target sensitive data; The determining unit is used to determine the desensitization prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category; A generation and establishment unit is used to combine a structure-preserving template corresponding to the sensitive data category and a distinguishing sequence identifier to generate a desensitized replacement value corresponding to the target sensitive data, and to establish a mapping relationship between the desensitized replacement value and the target sensitive data; A conversion and sending unit is used to convert the original request into a de-identified request based on the de-identified replacement value and send it to the target model; The restoration and output unit is used to receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

[0015] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method described in the first aspect.

[0016] This invention provides a data anonymization and restoration method, comprising: acquiring an original request to be processed, the original request containing target sensitive data; determining an anonymization prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category; generating an anonymization replacement value corresponding to the target sensitive data by combining the structure retention template corresponding to the sensitive data category and the distinguishing sequence identifier, and establishing a mapping relationship between the anonymization replacement value and the target sensitive data; converting the original request into an anonymized request based on the anonymization replacement value and sending it to the target model; receiving the complete response data returned by the target model, performing overall restoration on the complete response data based on the mapping relationship, and outputting the restored complete content. As described above, the data desensitization and restoration method of the present invention generates desensitized replacement values ​​by combining the structure retention template corresponding to the sensitive data category and the distinguishing sequence identifier. While ensuring data availability, it effectively preserves the type and structural characteristics of sensitive data and gives entities unique distinguishability, thereby avoiding semantic confusion in numerical reasoning and format verification of the model. At the same time, by converting the original request into a desensitization request and sending it to the target model, and performing overall restoration after receiving complete response data, the risk of restoration failure or leakage of sensitive information is greatly reduced, realizing high-security, high-precision data desensitization and lossless restoration in large model interaction scenarios. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a data desensitization and restoration method provided in an embodiment of the present invention; Figure 2 This is a structural block diagram of a data desensitization and restoration device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] To facilitate understanding of this embodiment, a data desensitization and restoration method disclosed in this embodiment of the invention will first be described in detail.

[0021] Example 1: like Figure 1 As shown, this embodiment provides a data anonymization and restoration method. This method is applied to stages such as large language model proxy gateways, client SDKs, or batch processing preprocessing tools that require sending text into large language model inference. It aims to solve the problems of existing anonymization techniques damaging data structure and semantic relationships, as well as restoration failures in streaming response scenarios. The method mainly includes the following steps: Step S101: Obtain the original request to be processed. The original request contains target sensitive data. Specifically, the original request is usually initiated by the upstream caller, and its content may contain sensitive information such as ID card number, mobile phone number, bank card number, password, API key, or internal business terms. If this data is sent directly to a third-party model service, there will be a serious risk of data leakage. The original request obtained in this step includes not only the text content entered by the user, but may also contain metadata in the request header. The system needs to identify the target sensitive data fragments that need to be de-identified to provide the input basis for subsequent processing.

[0022] Step S102: Determine the de-identification prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category. The core purpose of this step is to establish a semantic benchmark for the subsequent generation of de-identification replacement values. Unlike the simple use of fixed masks or general tokens in existing technologies, this embodiment dynamically determines the de-identification prefix, enabling the generated de-identification replacement value to carry the type characteristics or business semantics of the target sensitive data. For example, for structured data, the prefix may reflect the format characteristics of the data itself; for custom business data, the prefix may reflect the specific business meaning configured by the administrator. The specific priority logic for accurately determining the prefix based on configuration attributes or sensitive data categories will be elaborated in detail in subsequent embodiments. Here, it is only clarified that this step implements the mapping function from the original sensitive data (i.e., the target sensitive data) to the semantic prefix.

[0023] The above matching rules can be a set of sensitive data identification and de-identification strategy configurations, including sensitive data feature identification conditions and de-identification parameter configurations (such as prefix, category, algorithm).

[0024] Step S103: Combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier, a de-identified replacement value corresponding to the target sensitive data is generated, and a mapping relationship is established between the de-identified replacement value and the target sensitive data. Specifically, the structure-preserving template ensures that the de-identified replacement value remains consistent with the original sensitive data (i.e., the target sensitive data) in overall length, character set, and key identifier bits, enabling the large language model to still recognize the de-identified value as the corresponding data type, thereby maintaining numerical reasoning and format verification capabilities. Simultaneously, the introduction of the distinguishing sequence identifier allows multiple similar sensitive entities in the same context to be replaced with different de-identified values ​​(i.e., de-identified replacement values), ensuring the model's understanding of entity relationships. During this process, the system maintains a mapping relationship (such as a MaskMap) in memory in real time, recording the bidirectional correspondence between each de-identified replacement value and its corresponding original target sensitive data. This mapping relationship is the sole basis for subsequent response restoration. The specific composition of the template, the generation strategy of the sequence identifier, and the storage mechanism of the mapping relationship will be further elaborated in subsequent embodiments.

[0025] Step S104: Convert the original request into a de-identified request based on the de-identified replacement value and send it to the target model.

[0026] Step S105: Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

[0027] Through the sequential coordination of steps S101 to S105 described above, this embodiment constructs a complete data desensitization and restoration process. This process achieves semantically lossless desensitization generation on the input side by combining a structure-preserving template with a distinguishing sequence identifier. It should be understood that although... Figure 1 The linear execution order of the above steps is illustrated. However, in actual engineering implementations, some steps may involve parallel processing or asynchronous callbacks. As long as the above functional logic and data flow are satisfied, they fall within the protection scope of this application. Furthermore, the specific implementation methods mentioned in this embodiment, such as prefix determination, template generation, and format conversion, are only functional overviews. Their detailed preferred implementation methods will be elaborated one by one in subsequent content.

[0028] Step S102 is further detailed here, mainly explaining the specific logic for determining the de-identification prefix. In this embodiment, the process of determining the de-identification prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category adopts a three-level priority judgment mechanism to ensure that the generated de-identification prefix can not only meet the administrator's precise semantic control needs, but also adapt to the structural characteristics of different types of data.

[0029] Specifically, the three-level priority judgment mechanism includes the following processing logic: First, the first priority judgment is executed. If the matching rule is configured with a custom desensitization prefix, then that custom desensitization prefix is ​​directly used as the desensitization prefix. This level gives system administrators the ability to perform precise semantic control over specific business rules. In practical applications, some custom business rules may match multiple different types of content simultaneously. If only automatic inference is relied upon, semantic distortion is very likely to occur. For example, suppose an administrator creates a custom rule named "games," whose keyword library contains two entries: "a popular MOBA game" and "a casual party game," and the sensitive data category is marked as a custom category. If no custom desensitization prefix is ​​configured, and the traditional automatic inference mechanism is used, the system may extract "MOBA" as the prefix from the first hit sample "a popular MOBA game," causing the subsequent hit "a casual party game" to be incorrectly desensitized as "MOBA0002." This desensitization result will cause the large language model to mistakenly believe that both entities are related to "MOBA," thus returning a seriously ambiguous answer. By introducing a custom desensitization prefix in the first priority (e.g., configuring the mask_prefix field to "game"), regardless of whether the content hit is "a popular MOBA game" or "a casual party game", "game" is used as the prefix to generate desensitized values ​​(such as game0001, game0002), thereby fundamentally eliminating semantic misleading caused by sample differences and ensuring the accuracy of the model's understanding of business entities.

[0030] If the matching rule is not configured with a custom desensitization prefix, it will proceed to the second level of judgment, that is, branch processing based on the sensitive data category.

[0031] When the sensitive data category is unstructured, the rule identifier of the matching rule is used as the de-identification prefix. Unstructured categories typically refer to data types that lack fixed length or format characteristics, such as passwords, API keys, internal credentials, or custom business terms. For this type of data, since it lacks extractable structured features and the business meanings of different rules vary significantly, directly using the rule identifier (rule_name) as the prefix is ​​the optimal choice. For example, for sensitive data matched by a rule named "api_key", directly using "api_key" as the prefix to generate a de-identified value (such as api_key0001) allows the large language model to recognize that the data belongs to the API key type, while also conveying a clear business context through the rule name, avoiding information loss caused by using generic placeholders.

[0032] When the sensitive data category is a structured category, a de-identified prefix is ​​inferred from the first matching sample of the target sensitive data. Structured categories refer to data types with fixed lengths, character sets, or specific format identifiers, such as mobile phone numbers, ID card numbers, bank card numbers, and email addresses. For this type of data, preserving its original structural features is crucial for maintaining the numerical inference, format validation, and length judgment capabilities of large language models. Therefore, without configuring a custom prefix, the system automatically analyzes the first matching sample of this category in the current request and extracts its header features as the prefix. For example, for the mobile phone number category, if the first matching sample is "138", a de-identified prefix is ​​generated. "5678", the system can extract the first three digits "138" as a de-identification prefix; for ID card number categories, if the first matching sample is "110105"... The system can extract the first six digits "110105" from "1234" as a desensitization prefix. This sample-based inference method ensures that the generated desensitized replacement value is visually and structurally consistent with the original data, allowing the model to still recognize it as a valid data type and perform the corresponding inference task.

[0033] Through the aforementioned three-level priority chain, a prefix decision system that balances semantic controllability and backward compatibility is constructed. The first priority resolves semantic ambiguity issues under multi-morphological matching; the second priority provides a universal semantic anchor for unstructured data; and the third priority preserves necessary type features for structured data. It should be understood that although this embodiment describes a specific execution order of "custom priority → category judgment → rule name / sample inference," in other embodiments, as long as the judgment logic for these three prefix sources is included, even if the judgment order is adjusted or additional fallback strategies are added, as long as the function of dynamically determining the de-identified prefix based on configuration attributes or data categories can be achieved, it should be covered within the scope of protection of this application. Furthermore, this focus only on determining the source of the de-identified prefix string itself; how to further generate complete de-identified replacement values ​​based on this prefix will be elaborated in detail in subsequent embodiments.

[0034] Further refinement of the logic for generating desensitized replacement values ​​in step S103 is provided, focusing on how the combination of grouping strategies and distinguishing sequence identifiers achieves the distinguishability of entities of the same type and the semantic isolation of entities of different types. In this embodiment, the process of generating desensitized replacement values ​​corresponding to the target sensitive data by combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier first requires determining the grouping strategy based on the sensitive data category. Specifically, the grouping strategy is the core mechanism that determines the scope of the desensitization number counter, which directly affects the ability of the large language model to understand multiple sensitive entities in the context. This application adopts differentiated grouping keys for different types of data: when the sensitive data belongs to a structured category, it is grouped according to the sensitive data category itself; while when the sensitive data belongs to an unstructured category, it is grouped according to the rule identifier of the matching rule (such as the rule name, rule_name). The underlying logic of this differentiated design is that the type characteristics of structured data (such as mobile phone numbers and ID card numbers) are the strongest semantic anchors. Data of the same type usually has homogeneity in the business context. Therefore, sharing a global counter can maximize the preservation of the sequential association between entities. On the other hand, the semantics of unstructured data (such as custom keywords, passwords, and API keys) depend entirely on the specific business rule definition. Even if different rules match strings of the same form, their business meanings may be completely different. Therefore, physical isolation must be carried out with rule identifiers as boundaries to prevent conflicts or semantic interference between the numbering of different business domains.

[0035] After determining the grouping strategy, the system generates monotonically increasing distinguishing sequence identifiers within the group to which the target sensitive data belongs. This monotonic increase is not merely a simple counting action, but a crucial signal conveying entity differentiation to the large language model. In natural language processing tasks, when a model sees a series of tokens with the same prefix but continuously increasing suffix numbers, it can implicitly infer that these tokens represent different individuals within the same category of things, and that they appear in a specific order in the original text. This sequential information is crucial for reasoning tasks such as referential resolution and relation extraction. For example, if multiple phone numbers are all replaced with the same mask, the model will be unable to distinguish between the first and second mentioned phone numbers; however, through monotonically increasing sequence identifiers, the model can establish a clear entity correspondence. It should be noted that in this embodiment, monotonic increase means that within the processing cycle of the current request, whenever a new target sensitive data belonging to the group is hit, the counter increases based on the previous value, thereby ensuring that each target sensitive data within the same group receives a unique and ordered sequence number.

[0036] Finally, based on the structure-preserving template, the desensitization prefix, and the distinguishing sequence identifier, a desensitized replacement value is generated. This step transforms the aforementioned logical abstraction into a concrete string output. To more clearly illustrate the actual operation of the above grouping and numbering mechanism, a detailed demonstration is provided below using a multi-phone number scenario. Assume the original request text is "Help me organize the following customer information: Zhang San's mobile number 138..." 1234, Li Si's mobile phone number 137 3333, Wang Wu's mobile phone number 189 5555". In this scenario, the upstream detector identifies three sensitive data targets. Although the original prefixes of these three phone numbers are "138", "137", and "189" respectively, under the grouping strategy of this application, since their sensitive data category is "phone" (structured category), the system will group them into the same grouping context. During processing, the system does not maintain a separate counter for each different original prefix, but rather the "phone" group shares a global counter. Therefore, according to the order in which they appear in the text, the first one to be hit, "138", will be grouped into the same grouping context. "1234" was assigned the sequence identifier "1" (i.e., the distinguishing sequence identifier), and the second hit was "137". "3333" was assigned the sequence identifier "2", and the third hit was "189". "5555" was assigned the sequence identifier "3". Subsequently, combined with the anonymized prefix determined in the aforementioned content (e.g., "138" inferred from the first sample) and the preset structure preservation template, the three mobile phone numbers were generated as "13800000001", "13800000002" and "13800000003" respectively.

[0037] Through the above processing method, this embodiment achieves two levels of technical effects: First, within a group, the monotonically increasing distinguishing sequence identifier ensures that even entities of the same type with completely different original values ​​(such as different number segments) can obtain continuous and distinguishable desensitized representations, enabling the large language model to accurately identify that these are three different mobile phone number entities and preserve their relative order in the original text. Second, between groups, differentiated grouping keys (structured by category, unstructured by rule name) ensure that data streams with different business semantics do not interfere with each other. For example, if the same request also contains unstructured data "a popular MOBA game" that matches the "game" rule, this data will be classified into an independent group with the "game" rule identifier as the key, and its sequence identifier will be recalculated starting from 1. The generated desensitized value (such as game0001) will never overlap or confuse with the number sequence of the mobile phone number. This refined grouping management mechanism is an important foundation for this application to maintain semantic losslessness and structural fidelity even in complex mixed data scenarios. It should be understood that although the above example demonstrates a specific grouping key selection method, in other implementations, as long as the principles of clustering similar data and isolating dissimilar data are followed, and other fields that can uniquely identify the semantic domain of the data are used as the grouping basis, they should all be covered within the scope of protection of this application. Furthermore, this embodiment only focuses on the grouping logic and the generation mechanism of the distinguishing sequence identifier. The specific formatting details regarding how the distinguishing sequence identifier is converted into a fixed-length zero-padding number and concatenated with a prefix will be further detailed in subsequent sections.

[0038] This section further details how the generated distinguishable sequence identifiers are converted into the final desensitized replacement values. Based on the structure-preserving template, the desensitization prefix, and the distinguishable sequence identifiers, the process of generating the desensitized replacement values ​​specifically includes: converting the distinguishable sequence identifiers into fixed-length zero-padding numbers; and concatenating the desensitization prefix with the zero-padding numbers to obtain the desensitized replacement values. This step is crucial in transforming abstract logical sequences into string entities that conform to the cognitive habits of large language models. Specifically, fixed-length zero padding refers to padding the numeric distinguishable sequence identifiers with zeros at the higher bits within a preset bit width, making them equal-length numeric strings. For example, if the preset bit width is 8 bits, the sequence identifier "1" is converted to "00000001", and the sequence identifier "123" is converted to "00000123". This fixed-length processing not only ensures that all desensitized replacement values ​​within the same group have a uniform visual length, but more importantly, it maintains the data format characteristics, enabling downstream models to process desensitized data as if it were the original data when performing regular expression matching, length verification, or numerical comparison, thus avoiding format parsing errors caused by variable-length numbering.

[0039] Based on this, the generation of desensitized replacement values ​​follows a structure-preserving template to ensure that the overall length and character set of the desensitized replacement values ​​remain consistent with the original form of the target sensitive data. This structure-preserving template defines the skeleton structure of a specific sensitive data category, specifying the combination of prefixes, numbers, and suffixes. To fully support this feature, examples of template construction for several typical data types are listed below: For the mobile phone number category, its original form is 11 digits. The corresponding structure retention template is designed as "3-digit prefix + 8-digit zero-padding number". For example, when the desensitized prefix is ​​determined to be "138", the generated desensitized replacement values ​​are "13800000001", "13800000002", etc. This desensitized value (i.e., the desensitized replacement value) strictly maintains the length and character set of 11 digits, and the model can still recognize it as a valid mobile phone number format.

[0040] For the ID card number category (id_card), its original form is 18 characters (including numbers and possible X's). The corresponding structure preservation template is designed as "6-digit regional code prefix + 12-digit zero-padding number". For example, when the desensitized prefix is ​​inferred to be "110101", the generated desensitized replacement value is "110101000000000001". This desensitized value preserves the regional code feature and total length of the ID card number, enabling the model to continue performing geographic information inference based on the regional code.

[0041] For the bank card number category (bank_card), its original form is usually 16 to 19 digits. The corresponding structure retention template is designed as "6-digit BIN prefix + 13-digit zero-padded number". For example, when the desensitization prefix is "622200", the generated desensitization replacement value is "622200000000000001". This design retains the issuer identification information, and at the same time fills the remaining digits with a fixed-length number, maintaining the numerical structure of the card number.

[0042] For the email address category (email), its original form includes a username, the @ symbol and a domain name. The corresponding structure retention template is designed as "prefix + 4-digit zero-padded number + fixed domain name suffix". For example, when the desensitization prefix is "zh", the generated desensitization replacement value is "zh0001@example.com". This template not only retains the @ delimiter and domain name structure of the email, but also ensures that the desensitized value is still a legally valid email address in syntax through the fixed suffix, preventing the model from generating hallucinations due to illegal formats.

[0043] For the license plate number category (pii), its original form includes a provincial abbreviation, letters and subsequent codes. The corresponding structure retention template is designed as "2-digit provincial and municipal code prefix + 6-digit zero-padded number". For example, when the desensitization prefix is "京A", the generated desensitization replacement value is "京A000001". This desensitized value (i.e., the desensitization replacement value) completely retains the regional attribution feature and code length of the license plate.

[0044] It should be understood that the above examples are only illustrative and not restrictive. In practical applications, administrators can overwrite or customize the preset templates according to business needs, for example, adjusting the default prefix of the mobile phone number from "138" to "139", or configuring the localized domain name in the email template to another suffix. As long as the principle that the overall length and character set are consistent with the original form is satisfied, all fall within the protection scope of this application. In addition, regarding the design of number capacity, the zero-padded bit width reserved for each category is sufficient to cover the actual number of hits in a single request. For example, the 8-digit number space for mobile phone numbers supports up to 99.99 million hits, and the 12-digit number space for ID numbers supports trillion-level hits, which is almost impossible to exhaust in conventional business scenarios. However, in extreme abnormal situations, if number overflow occurs, the system can be configured to throw an exception and automatically degrade to the general token (such as <TOKEN_n>) mode, so as to avoid the desensitized value overlapping with the original text or causing unexpected truncation, thereby ensuring the robustness and security of the system.

[0045] By employing the aforementioned template retention and zero-padding concatenation mechanism, this embodiment achieves a high-fidelity simulation of the original data in form from the anonymized data. This high fidelity is not merely for visual similarity, but also for maintaining the reasoning ability of the large language model at the semantic level. When the model receives an anonymized value like 13800000001, its internal word segmentation results, attention mechanism's focus on digits, and subsequent numerical calculation logic are all highly consistent with those when processing real mobile phone numbers. In contrast, if generic placeholders are used, the model will completely lose its ability to perceive the numerical value and verify the format of the data. Therefore, the technical solution of this embodiment is the material basis for ensuring that the model's reasoning quality does not decline after anonymization.

[0046] Here, step S104 regarding the process of converting the request into a de-identified request is further detailed. In this embodiment, converting the original request into a de-identified request based on the de-identified replacement value and sending it to the target model includes: In response to the original request being a chunked streaming request with a non-empty mapping relationship, the original request is converted into a non-streaming desensitized request based on the desensitized replacement value and sent to the target model. This is a key preliminary step in solving the restoration problem in streaming scenarios in this embodiment. When a client initiates a chunked streaming request (e.g., an SSE streaming request), and the current request does indeed contain sensitive data (i.e., the mapping relationship is not empty), the system internally intercepts the request and forcibly converts it into a non-streaming request before sending it to the target model. This internal degradation strategy is completely transparent to the client; the client still believes it is initiating a streaming request, but the target model actually receives the complete request. This conversion is necessary because in true chunked streaming, a complete desensitized replacement value is very likely to be split into two or more data blocks, causing a mismatch when replacing one block at a time, resulting in the leakage of desensitized placeholders or restoration failure. By converting the request to non-streaming, it ensures that the target model returns a response body containing the complete context, creating the necessary conditions for subsequent overall restoration. The specific implementation details of request interception and identifier modification will be detailed in subsequent embodiments.

[0047] Receive the complete response data returned by the target model, perform overall reconstruction of the complete response data based on the mapping relationship, and output the reconstructed complete content, including: The system receives the complete response data returned by the target model, performs overall restoration based on the mapping relationship, and outputs the restored complete content in a chunked streaming format. Since the upstream request has been converted to non-streaming, this step receives the complete response body returned by the target model. Using the mapping relationship established in step S103, the system iterates through the complete response string (i.e., the complete response data) to find all de-identified replacement values ​​and restores them to the original target sensitive data in one go. This overall restoration method completely avoids the technical obstacles of cross-data block matching, ensuring the accuracy and completeness of the restoration. Subsequently, to meet the client's original streaming interaction expectations, the system repackages the restored complete content into data blocks conforming to the chunked streaming transmission protocol format, adds appropriate end markers, and outputs it to the client. This ensures both data security and restoration reliability while maintaining client interface compatibility. The execution order of the overall restoration and the specific protocol adaptation for streaming format synthesis will be described in detail in subsequent embodiments.

[0048] The request transformation mechanism in streaming scenarios is further detailed below. The process of converting the original request into a non-streaming desensitized request based on desensitized replacement values ​​and sending it to the target model specifically includes: intercepting the original request; modifying the streaming transmission identifier in the original request to a non-streaming identifier, and replacing the target sensitive data with desensitized replacement values ​​to obtain a non-streaming desensitized request; and sending the non-streaming desensitized request to the target model. This mechanism constitutes the first line of defense in solving the streaming response restoration problem in this application. Its core lies in fundamentally eliminating the uncertainty in the data transmission process through proactive intervention at the proxy layer, without changing the client's expected interaction.

[0049] Specifically, the aforementioned conversion operation relies on strict degradation judgment conditions. Before forwarding a request, the system checks in real time whether the current request simultaneously meets two prerequisites: First, the mapping relationship (MaskMap) recorded in the memory mapping module is not empty, meaning that the current request does indeed hit the target sensitive data and generate the corresponding de-identified replacement value; second, the streaming transmission identifier carried in the original request indicates that the client expects to receive a chunked streaming response (e.g., the stream parameter is true). Only when both conditions are met will the system enter the degradation processing path. If the mapping relationship is empty, it means that the request content does not involve sensitive information, and the system will keep the original streaming transmission channel unchanged to avoid unnecessary latency loss; if the original request itself is not streaming, there is no need to modify the identifier, and a regular replacement can be performed directly. This fine-grained condition judgment ensures that the system only incurs degradation costs when necessary, maximizing the balance between security and user experience.

[0050] After the degradation conditions are met, the proxy layer intercepts and rewrites the original request. Interception here refers to capturing the request during the memory processing stage before it leaves the system and reaches the target model, rather than blocking it at the network layer. The system forcibly modifies the streaming identifier in the request object to a non-streaming identifier (e.g., rewriting `stream=true` to `stream=false`). Simultaneously, it uses the de-identified replacement value generated in the aforementioned embodiment to fully replace the target sensitive data in the request body. The resulting non-streaming de-identified request is structurally a standard synchronous request expecting a complete response body. The system then sends this non-streaming de-identified request to the target model. It is important to emphasize that this rewriting process is completely transparent to the client. The client maintains the session state and parsing logic from when it initiated the streaming request and is unaware that the upstream request has been tampered with. This transparent design allows this application to be seamlessly integrated into existing large language model call chains without any adaptation modifications to the client SDK or business code, significantly reducing the deployment threshold.

[0051] To more clearly illustrate why requests must be converted to non-streaming, we will explain this from the perspective of the micro-mechanisms of data flow. In chunked streaming protocols (such as Server-Sent Events), the response content is divided into multiple independent data chunks and sent sequentially. Due to the uncertainty of network transmission and the fluctuation of model generation speed, a complete de-identified replacement value is very likely to be physically split into two or more data chunks. For example, suppose the de-identified replacement value of a mobile phone number is "13800000001". In extreme cases, the first data chunk may end with "...138000" and the second data chunk may start with "00001...". If the system attempts to perform string replacement immediately upon receiving each data chunk, since a single data chunk does not contain the complete de-identified replacement value, regular expression matching or string search algorithms will fail to find it, causing the de-identified placeholder to be leaked to the end user as is, or causing broken and garbled text in the restored text. In contrast, by downgrading the upstream request to non-streaming, the system forces the target model to return a response body containing the complete context. Only after obtaining the complete response string can the system perform a global replacement, thus completely avoiding the risk of matching failure caused by cross-block truncation. Although this approach causes the request to lose the real-time streaming experience of word-by-word output (increased first-packet latency), it is a necessary technical means to ensure zero leakage of sensitive data and zero errors in the restoration result. It should be understood that the modification of the streaming identifier described in this embodiment is only one specific implementation. In other embodiments, the same request conversion function can also be achieved by constructing a new non-streaming request object, calling a non-streaming dedicated interface, etc. As long as the purpose of obtaining a complete response body to support overall restoration can be achieved, it should be covered within the protection scope of this application.

[0052] This section further refines the response-side processing logic in step S105, focusing on how to perform a reliable restoration operation after obtaining the complete response and convert the result into the streaming format expected by the client. In this embodiment, the process of performing overall restoration of the complete response data based on the mapping relationship and converting the restored complete content into a chunked streaming format for output specifically includes: serializing the complete response data into a string; traversing the mapping relationship and restoring the de-identified replacement values ​​to the target sensitive data in the string to obtain the restored complete content; encapsulating the restored complete content into data blocks conforming to the chunked streaming transmission protocol format; appending an end marker to the data block and outputting it to the client.

[0053] Specifically, since the complete response data returned by the target model is usually a structured JSON object, and the string replacement operation needs to be performed at the plain text level, the system first serializes the complete response data into a string. This step ensures that the subsequent restoration operation can cover all text fields in the response body, including but not limited to assistant reply content, function call parameters, or embedded metadata. During the replacement, the system traverses the mapping relationship (MaskMap) maintained in memory, replacing all matching desensitized replacement values ​​in the string back to the original target sensitive data at once. To further improve the robustness of the restoration process and prevent mismatches caused by short desensitized values ​​being prefixes of long desensitized values ​​in extreme cases (although the fixed-length template design in the aforementioned embodiments has largely mitigated this risk), this embodiment preferably adopts a strategy of traversing the mapping relationship in descending order of desensitized replacement value length. That is, longer desensitized values ​​are replaced first, followed by shorter desensitized values, thereby completely eliminating the possibility of substring mismatches at the algorithm level. After the replacement is completed, the system deserializes the restored string (the restored complete content) into a standard response object, preparing for subsequent protocol encapsulation.

[0054] After obtaining the restored complete content, the system needs to repackage it into data blocks conforming to the chunked streaming protocol format to meet the client's original streaming interaction expectations. This synthesis process is the key to achieving seamless client interaction in this application. Taking the industry-standard Chat Completions interface as an example, the system will encapsulate the restored complete assistant text in a standard chat.completion.chunk event object, whose choices[0].delta.content field contains the complete restored text. Then, the system will generate an end chunk event, where the finish_reason field is set to "stop", along with usage statistics, and finally output the "data: [DONE]" termination flag. For other protocol types such as the Responses interface, the system will also generate the corresponding response.completed event and termination flag according to its specifications. Through this standardized synthesis output, the client SDK does not need to make any code modifications or adaptations to parse and display the complete content as if it were a real streaming response. The only difference in experience is that the streaming output perceived by users is no longer generated word by word, but rather the complete result is presented all at once after a short wait. However, this is the small price that must be paid to ensure zero leakage of sensitive data.

[0055] To more clearly illustrate the technical advantages of this embodiment, a comparative analysis is conducted below using a streaming response degradation and restoration case. Assume that without the proposed solution, the system attempts to replace the actual segmented streaming response block by block. When the de-identified replacement value "13800000001" is split into two independent data blocks, "138000" and "00001," the string matching algorithm for a single data block will be unable to identify the complete de-identified replacement value, causing the placeholder to be leaked to the end user as is, or resulting in broken or garbled text in the restored text. This embodiment, through a three-step strategy of internal degradation to obtain the complete response → overall string restoration → standardized SSE synthesis, fundamentally cuts off the path of cross-block splitting of the de-identified placeholder, ensuring that regardless of network transmission fluctuations, the end user always receives a complete and correct response content containing the original target sensitive data. It should be understood that although the above example uses the SSE protocol of the Chat Completions interface as an example for detailed explanation, in other implementations, as long as the core concept of overall restoration and encapsulation into the original protocol format is adopted, even if the specific protocol field names or event types are different, they should be covered within the protection scope of this application.

[0056] This section further defines the security management mechanism for establishing mapping relationships. In this embodiment, the method also includes: storing the mapping relationship only in the memory context of the current request processing cycle; and immediately clearing the mapping relationship in the memory context after the complete restored content is output, to prevent persistent storage or cross-request sharing of the mapping relationship. This mechanism constitutes the last line of defense in the data security defense system of this application, aiming to completely cut off the attack path for sensitive data to be reverse restored from the physical storage level.

[0057] Specifically, storing the mapping relationship only in the memory context of the current request processing cycle means that MaskMap, as a volatile temporary data structure, has its lifecycle strictly limited to the thread or coroutine scope processing the single original request. In engineering implementation, this is typically manifested by using thread-local variables (ThreadLocal), request scope objects, or context containers of asynchronous tasks to hold the mapping data. For example, when the gateway receives a new API call request, the system allocates a separate memory space in the processing thread stack corresponding to that request to initialize MaskMap; as the request processing flow ends or thread resources are reclaimed, this memory space will be automatically released or overwritten. During this process, the system is configured to strictly prohibit writing any key-value pairs in MaskMap to relational databases, NoSQL caches, local file systems, audit logs, or any form of external persistent media. Even in scenarios requiring troubleshooting or security auditing, it is only allowed to temporarily view the data in memory through a controlled debugging interface, and it is never persisted to disk. This zero-persistence design principle ensures that even if an attacker gains access to the system's database or log files, they cannot extract any mapping credentials that can be used to reverse-engineer the original sensitive data.

[0058] Regarding the timing requirement of immediately performing the cleanup operation after the complete restored content is output, "immediately" here does not refer to a millisecond-level response in absolute time, but rather to tight coupling and atomicity guarantees in the program execution logic. Specifically, the cleanup operation must be anchored within a specific time window: after the response data has been sent to the client and before the computing resources occupied by the current request have been released. Whether the cleanup is performed synchronously in the callback of the send function or asynchronously in the response stream closing event, it must be ensured that within the same request processing context, the clearing of the mapping relationship is completed before the destruction of the context. For example, in the streaming degradation synthesis scenario described above, after the last data block containing the end marker is written to the network socket buffer, the system should immediately call the cleanup method of MaskMap or set its reference to null, rather than waiting for the garbage collector to reclaim it at some uncertain time in the future. This deterministic destruction mechanism effectively prevents residual data caused by memory reuse from being accidentally read by subsequent requests, thereby eliminating the risk of cross-request data interference.

[0059] Through the aforementioned lifecycle management and security isolation mechanisms, this embodiment achieves read-and-burn functionality for mapping data (i.e., mapping relationships). Compared to existing solutions that persistently store de-identified mapping tables for subsequent querying or reuse, this application's technical solution, while sacrificing some convenience in historical tracing, achieves extremely high security gains. In existing solutions, once the database storing the mapping table is leaked, attackers can use the table to batch reverse-engineer all historically de-identified sensitive data, causing catastrophic privacy breaches. This application, by restricting mapping relationships to transient memory and destroying them immediately after use, makes each de-identification and restoration process an independent, unrecoverable security event. Even if the system itself is compromised, attackers can only obtain a very small fragment of data currently being processed, and cannot steal the entire historically accumulated mapping relationships. This inherent security capability based on architectural design provides solid underlying support for data compliance and privacy protection in large language model application scenarios. It should be understood that although this embodiment describes a specific implementation based on memory context, in other implementations, as long as the security constraints of non-persistent mapping relationships, non-sharing across requests, and timely clearing after response are met, other equivalent temporary storage and destruction techniques should be covered within the scope of protection of this application.

[0060] This section provides supplementary explanations for scenarios where the aforementioned content does not trigger streaming degradation processing. The aim is to ensure that the data anonymization and restoration methods can cover all request states, avoiding functional deficiencies or performance degradation due to unmet specific conditions. In this embodiment, the method also includes fallback processing logic for non-streaming requests and requests without sensitive data hits.

[0061] Specifically, in response to a non-streaming request, the sensitive data in the original request is replaced with the corresponding desensitized replacement value to obtain a desensitized request, which is then sent to the target model. Upon receiving the response data returned by the target model, if the mapping relationship is not empty, a restoration operation is performed on the response data based on the mapping relationship. This processing branch constitutes the standard operating path of this application in the non-streaming interaction mode. Unlike the streaming degradation mechanism described above, when the system detects that the client initiates a normal synchronous request (i.e., a non-chunked streaming request), no modification is needed to the transmission identifier in the request header, nor is a complex streaming format synthesis operation required in the response phase. The system only needs to follow the conventional desensitization process, using the generated desensitized replacement value to perform string replacement on the original request body, and then send the desensitized request to the target model. After receiving the complete response body returned by the target model, the system directly traverses the mapping relationship in memory to perform the overall restoration and returns the restored response object to the client. By eliminating the computational overhead of protocol conversion and format encapsulation, this path has higher execution efficiency when processing non-streaming requests, while ensuring the integrity of the de-identification and restoration functions, and ensuring that sensitive data can receive consistent security protection regardless of the client's interaction mode.

[0062] As an alternative parallel or independent processing method, in response to an empty mapping relationship, the original request is directly passed through to the target model, and the response data returned by the target model is directly output. This processing branch is for scenarios where the current request does not contain any sensitive target data. In actual business traffic, not every user interaction involves sensitive information. When the upstream detection process does not find a match, or although a match is found, no de-identified replacement value is generated due to the filtering strategy, the mapping relationship in memory will remain empty. At this time, the system will automatically switch to pure pass-through mode, skipping all de-identification generation, request rewriting, and response restoration steps, forwarding the original request to the target model unchanged, and directly sending the response data returned by the model back to the client. This design minimizes system resource consumption and ensures that in normal business interactions that do not involve sensitive data, the intervention of this application will not introduce any additional processing latency or computational load, thereby maintaining the original service performance indicators.

[0063] Through the design of the two bypass logics described above, this embodiment constructs a processing framework with high robustness and adaptability. On the one hand, it ensures that the method can run correctly under various request types (streaming and non-streaming) and data states (hit and miss), eliminating functional blind spots; on the other hand, this refined traffic splitting mechanism demonstrates excellent backward compatibility. For existing business rules or scenarios without configured de-identification strategies, the system can automatically identify and follow the pass-through path, smoothly upgrading to the security protection system of this application without modifying existing code or configuration. It should be understood that although this embodiment describes non-streaming processing and miss processing as two independent cases, in actual system implementation, these two are usually conditional branches of the main process (streaming degradation processing). The system dynamically selects the optimal execution path based on the real-time runtime state. This flexible routing mechanism is the key to this application's ability to ensure security while also considering business performance.

[0064] The following section further elaborates on the integration and application of the aforementioned data anonymization and restoration methods in different business systems, as well as their ability to be extended for specific environments, to demonstrate the versatility and environmental adaptability of this technical solution. It should be understood that the technical solution provided in this application does not rely on a specific large language model proxy gateway, but can be embedded as an independent functional component or software development kit into any system that needs to send text into large language model inference.

[0065] In a typical integrated scenario, this data anonymization and restoration method can be encapsulated as a desktop client software development kit (SDK). Specifically, when a user interacts with a large language model in a desktop application, the SSD can complete the sensitive data identification and anonymization processing of the input text in local memory after the user clicks the send button but before the actual network request is sent. The advantage of this localized processing mode is that the original sensitive data never leaves the user's terminal in plaintext form. Even if the network transmission channel is eavesdropped on, the attacker only obtains the replaced value after structure preservation and anonymization, thus minimizing the risk of data leakage. At the same time, since the anonymization and restoration logic are completed in a closed loop on the client side, the server does not need to maintain any mapping state, greatly simplifying the complexity of the cloud architecture.

[0066] In another integrated scenario, this method can be applied to the document preprocessing stage of batch processing tools or retrieval enhancement generation systems. Before constructing vector indexes or batch feeding enterprise knowledge base documents as context into a large language model for fine-tuning, the batch processing tool calls the de-identification module of this application to scan and replace massive amounts of documents. In this way, it can be ensured that the corpus stored in the vector database or sent to the model does not contain any personal privacy or trade secret information. More importantly, due to the use of structure-preserving templates and distinguishable sequence identifiers, the model can still correctly understand the relationships and data types between entities when processing de-identified documents, avoiding semantic breaks caused by traditional masking de-identification, thereby ensuring the inference quality of retrieval enhancement generation or fine-tuning tasks.

[0067] In the context of intelligent upgrades to enterprise instant messaging tools, this method can be deployed as a message forwarding plugin within the communication chain. When an employee sends a message containing sensitive information to an AI assistant in a chat window, the plugin intercepts and de-identifies the message in real time before it enters the large language model service. Once the model's response is received, the message is automatically restored to its original content and presented to the user. The entire process is completely transparent to both parties in the chat, meeting enterprise compliance audit requirements without altering employees' existing communication habits. This real-time interception mechanism is particularly suitable for collaborative office environments that are sensitive to response delays but must ensure data security.

[0068] In addition to the aforementioned integration scenarios, the technical solution of this application also possesses several extended implementation capabilities to adapt to the differentiated needs of different regions and business stages. Firstly, regarding template configuration, although the system pre-sets default templates for common structured data, it allows administrators to override these pre-set templates according to the enterprise's own anonymization and auditing preferences. For example, an administrator can change the default anonymization prefix for mobile phone numbers from 138 to 139, or adjust the bit width of zero-padding numbers. This configurable design allows the same system to adapt to the compliance standards of different enterprises without modifying the underlying code.

[0069] Secondly, regarding multilingual and localization adaptation, the fixed parts of the structure-preserving template can be dynamically configured according to the deployment region. For example, the domain suffix in the email address template can be automatically switched to a commonly used local domain name based on the server's location, and the province code in the license plate template can also be localized according to the vehicle's registration location. This fine-grained adaptation capability ensures that the anonymized values ​​still possess reasonable semantic features in specific cultural contexts, avoiding misjudgments by the model due to the lack of regional characteristics.

[0070] Secondly, to address the troubleshooting needs of security operations personnel, the system provides a controlled debugging mode. In this mode, after strict permission verification and audit logging, the mapping relationships within the current request's lifecycle can be temporarily exported for problem analysis. It is important to emphasize that this export function exists only momentarily in memory and must be triggered with explicit authorization; it never alters the core security characteristic of zero persistence in mapping relationships. It is a supplementary means of striking a balance between extreme security and necessary operational convenience, not a compromise to security principles.

[0071] Furthermore, the system maintains excellent backward compatibility for sensitive data detected using keyword matching rather than regular expressions. When a keyword match is detected and no custom masking prefix is ​​configured, the system automatically uses the existing general masking interface for processing, ensuring that existing rules can be smoothly integrated into the new masking system without modification. This compatible design reduces migration costs for enterprises and protects investments in existing security assets.

[0072] Finally, the desensitization method of this application is completely decoupled from the upstream detection engine. The system relies solely on the standardized hit result data structure output by the upstream detector, without caring whether the detector internally uses regular expressions, keyword matching, machine learning models, or manual annotation to identify sensitive data. This means that enterprises can replace or upgrade the underlying sensitive data identification engine at any time without making any changes to the desensitization and restoration modules. This loosely coupled architectural design gives the system strong portability and room for technological evolution, enabling it to maintain its advanced status as artificial intelligence security technologies iterate. It should be understood that the above extended implementation methods are merely exemplary, and those skilled in the art can make other modifications and combinations according to actual business needs without departing from the core inventive concept of this application.

[0073] The technical solution provided in this application generates de-identified replacement values ​​by combining structure-preserving templates and distinguishing sequence identifiers. Template constraints ensure consistency between the de-identified values ​​and the original data in terms of length, character set, and key structural bits. Monotonically increasing sequence identifiers within groups ensure the distinguishability of entities of the same type. This allows large language models to correctly identify data types and understand the relationships between entities even after de-identification, significantly improving model inference quality. A three-level priority prefix decision mechanism grants administrators precise semantic control over custom business rules, avoiding semantic distortion and ambiguity caused by automatic inference under multi-morphological matching. Through an internal degradation and overall restoration mechanism in the streaming response, when a de-identification hit is detected, the upstream streaming request is transparently converted to a non-streaming request. After obtaining the complete response, an overall replacement is performed, and then it is encapsulated into a streaming format for output. This fundamentally solves the problem of restoration failure and leakage caused by de-identification placeholders being split across data blocks. By implementing request-level memory isolation and immediate clearing mechanisms for mapping relationships, zero persistence and zero cross-request sharing of mapping data are achieved, fundamentally blocking the attack path of reconstructing historical sensitive data through the mapping table, and greatly improving the level of data security protection.

[0074] Example 2: like Figure 2 As shown, this embodiment provides a data anonymization and restoration device. This device can be embedded as an independent functional component into a large language model proxy gateway, client SDK, or batch processing preprocessing tool to implement the data anonymization and restoration methods described in any of the foregoing descriptions. From a product architecture perspective, this device solidifies abstract method steps into specific functional units. Through data flow and collaborative cooperation between units, it completes the secure processing and transparent restoration of sensitive data. Specifically, the device includes: an acquisition unit 10, a determination unit 20, a generation and establishment unit 30, a conversion and sending unit 40, and a restoration and output unit 50, wherein: Acquisition unit 10 is used to acquire the original request to be processed, which contains target sensitive data; The determining unit 20 is used to determine the de-identification prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category; The generation and establishment unit 30 is used to combine the structure retention template corresponding to the sensitive data category and the distinguishing sequence identifier to generate the desensitized replacement value corresponding to the target sensitive data, and to establish the mapping relationship between the desensitized replacement value and the target sensitive data; The conversion and sending unit 40 is used to convert the original request into a de-sensitized request based on the de-sensitized replacement value and send it to the target model. The restoration and output unit 50 is used to receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

[0075] Optionally, the determining unit is further configured to: if the matching rule is configured with a custom desensitization prefix, use the custom desensitization prefix as the desensitization prefix; if the matching rule is not configured with a custom desensitization prefix, determine based on the sensitive data category: when the sensitive data category is an unstructured category, use the rule identifier of the matching rule as the desensitization prefix; when the sensitive data category is a structured category, infer and generate the desensitization prefix from the first matching sample of the target sensitive data.

[0076] Optionally, the generation and establishment unit is also used to: determine a grouping strategy based on the sensitive data category, wherein structured categories are grouped according to the sensitive data category, and unstructured categories are grouped according to the rule identifier of the matching rule; generate a monotonically increasing distinguishing sequence identifier within the group to which the target sensitive data belongs; and generate a desensitized replacement value based on the structure preservation template, the desensitization prefix, and the distinguishing sequence identifier.

[0077] Optionally, the generation and establishment unit is also used to: convert the distinguishing sequence identifier into a fixed-length zero-padding number; concatenate the desensitization prefix with the zero-padding number to obtain the desensitization replacement value; wherein the generation of the desensitization replacement value follows a structure-preserving template so that the overall length and character set of the desensitization replacement value are consistent with the original form of the target sensitive data.

[0078] Optionally, the conversion and sending unit is further configured to: in response to the original request being a chunked streaming transmission request and the mapping relationship being non-empty, convert the original request into a non-streaming desensitized request based on the desensitized replacement value and send it to the target model; the restoration and output unit is further configured to: receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and convert the restored complete content into a chunked streaming format for output.

[0079] Optionally, the conversion and sending unit is also used to: intercept the original request; modify the streaming identifier in the original request to a non-streaming identifier, and replace the target sensitive data in it with the de-identified replacement value to obtain a non-streaming de-identified request; send the non-streaming de-identified request to the target model; the restoration and output unit is also used to: serialize the complete response data into a string; traverse the mapping relationship, restore the de-identified replacement value in the string to the target sensitive data, and obtain the restored complete content; encapsulate the restored complete content into a data block conforming to the chunked streaming protocol format; append an end marker to the data block and output it to the client.

[0080] Optionally, the device is also configured to: store the mapping relationship only in the memory context of the current request processing cycle; and immediately perform a clear operation on the mapping relationship in the memory context after the complete content is output after restoration, so as to prevent persistent storage or sharing of the mapping relationship across requests.

[0081] Optionally, the conversion and sending unit is further configured to: in response to the original request being a non-streaming request, replace the target sensitive data in the original request with the corresponding desensitized replacement value to obtain a desensitized request, and send it to the target model; after receiving the response data returned by the target model, if the mapping relationship is not empty, perform a restoration operation on the response data based on the mapping relationship; the device is further configured to: in response to the mapping relationship being empty, directly pass through the original request to the target model, and directly output the response data returned by the target model.

[0082] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0083] like Figure 3 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the data desensitization and restoration method described above.

[0084] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned data desensitization and restoration method.

[0085] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0086] Corresponding to the above-described data desensitization and restoration method, this application embodiment also provides a computer-readable storage medium storing machine-executable instructions. When the machine-executable instructions are called and run by a processor, the machine-executable instructions cause the processor to perform the steps of the above-described data desensitization and restoration method.

[0087] The data desensitization and restoration device provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0088] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0089] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0090] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0091] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0092] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the data desensitization and restoration methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0093] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0094] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for data desensitization and restoration, characterized in that, include: Obtain the raw request to be processed, which contains target sensitive data; Based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category, determine the de-identification prefix; By combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier, a de-identified replacement value corresponding to the target sensitive data is generated, and a mapping relationship is established between the de-identified replacement value and the target sensitive data; Based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model; Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

2. The method according to claim 1, characterized in that, Based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category, a de-identification prefix is ​​determined, including: If the matching rule is configured with a custom desensitization prefix, then the custom desensitization prefix will be used as the desensitization prefix; If the matching rule is not configured with a custom de-identification prefix, then the judgment is made based on the sensitive data category: When the sensitive data category is an unstructured category, the rule identifier of the matching rule is used as the desensitization prefix; When the sensitive data category is a structured category, the desensitization prefix is ​​inferred from the first matching sample of the target sensitive data.

3. The method according to claim 1, characterized in that, By combining the structure-preserving template corresponding to the sensitive data category and the distinguishing sequence identifier, a de-identified replacement value corresponding to the target sensitive data is generated, including: A grouping strategy is determined based on the sensitive data category, wherein structured categories are grouped according to the sensitive data category, and unstructured categories are grouped according to the rule identifier of the matching rule; Within the group to which the target sensitive data belongs, a monotonically increasing distinguishing sequence identifier is generated; The desensitized replacement value is generated based on the structure retention template, the desensitization prefix, and the distinguishing sequence identifier.

4. The method according to claim 3, characterized in that, Based on the structure-preserving template, the desensitization prefix, and the distinguishing sequence identifier, the desensitization replacement value is generated, including: The distinguishing sequence identifier is converted into a fixed-length zero-padding number; The desensitization prefix is ​​concatenated with the zero-padding number to obtain the desensitization replacement value; The generation of the desensitized replacement value follows the structure preservation template so that the overall length and character set of the desensitized replacement value are consistent with the original form of the target sensitive data.

5. The method according to claim 1, characterized in that, Based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model, including: In response to the original request being a chunked streaming request and the mapping relationship being non-empty, the original request is converted into a non-streaming de-identified request based on the de-identified replacement value and sent to the target model; Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content, including: Receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and convert the restored complete content into a chunked streaming format for output.

6. The method according to claim 5, characterized in that, Based on the de-identified replacement value, the original request is converted into a non-streaming de-identified request and sent to the target model, including: Intercept the original request; The streaming identifier in the original request is modified to a non-streaming identifier, and the target sensitive data in it is replaced with the desensitized replacement value to obtain the non-streaming desensitized request. Send the non-streaming desensitization request to the target model; Based on the mapping relationship, the complete response data is restored as a whole, and the restored complete content is converted into a chunked streaming format for output, including: Serialize the complete response data into a string; Traverse the mapping relationship, restore the desensitized replacement value to the target sensitive data in the string, and obtain the restored complete content; The restored complete content is encapsulated into data blocks conforming to the chunked streaming transport protocol format; An end marker is appended to the data block, and the data is output to the client.

7. The method according to claim 1, characterized in that, The method further includes: The mapping relationship will be stored only in the memory context of the current request processing cycle; After the restored complete content is output, the mapping relationship in the memory context is immediately cleared to prevent the persistent storage or cross-request sharing of the mapping relationship.

8. The method according to claim 1, characterized in that, Based on the de-identified replacement value, the original request is converted into a de-identified request and sent to the target model, including: In response to the original request being a non-streaming request, the target sensitive data in the original request is replaced with the corresponding de-identified replacement value to obtain a de-identified request, which is then sent to the target model. After receiving the response data returned by the target model, if the mapping relationship is not empty, a restoration operation is performed on the response data based on the mapping relationship. The method further includes: If the mapping relationship is empty, the original request is directly passed through to the target model, and the response data returned by the target model is directly output.

9. A data desensitization and restoration device, characterized in that, include: The acquisition unit is used to acquire the original request to be processed, wherein the original request contains target sensitive data; The determining unit is used to determine the desensitization prefix based on the configuration attributes of the matching rules corresponding to the target sensitive data and / or the sensitive data category; A generation and establishment unit is used to combine a structure-preserving template corresponding to the sensitive data category and a distinguishing sequence identifier to generate a desensitized replacement value corresponding to the target sensitive data, and to establish a mapping relationship between the desensitized replacement value and the target sensitive data; A conversion and sending unit is used to convert the original request into a de-identified request based on the de-identified replacement value and send it to the target model; The restoration and output unit is used to receive the complete response data returned by the target model, perform overall restoration on the complete response data based on the mapping relationship, and output the restored complete content.

10. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 8.

Images