A method and apparatus for identifying sensitive data

Abstract

This application provides a method and apparatus for identifying sensitive data. A shared tag knowledge base is constructed, comprising tags for sensitive data belonging to multiple tenants. Each tenant's sensitive data tag includes encrypted data after extracting feature vectors from the context information of the sensitive data and encrypting them. Subsequently, encrypted vector search technology is used to search for matching encrypted data within the shared tag knowledge base. This enables the system to complete vector search within an encrypted domain, ensuring that the tenant's original sensitive data does not leave its security boundary. It resolves the contradiction between cross-tenant tag knowledge sharing and data privacy protection, achieving data usability without visibility. In other words, the solution provided in this application breaks down the tag knowledge barrier of a single tenant, reduces the workload of manual review and tagging, and significantly improves the accuracy and consistency of sensitive data classification.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and more specifically, to a method, apparatus, computing device cluster, computer program product, and computer-readable storage medium for identifying sensitive data. Background Technology

[0002] With the popularization of cloud computing technology, multi-tenant architecture has become the mainstream mode of cloud service delivery. Under this architecture, the hardware and software resources of a single service instance are shared by multiple tenants (which can also be understood as customers or users) to achieve intensive resource utilization and cost reduction. Data security, as the cornerstone of cloud services, has the identification, classification, and grading of sensitive data as one of its core aspects. Traditional data security solutions are typically designed in a single-tenant mode, meaning that each tenant's data identification and tagging management processes operate independently and in isolation.

[0003] However, this isolation model has significant limitations in multi-tenant cloud environments or multi-user systems. While different tenants may have different business domains and data content, they often share commonalities in data classification and grading standards (e.g., the definition and grading of personal identification information, financial data, and health information) and follow similar industry standards or regulatory requirements. The valuable experience accumulated by one tenant in data identification and labeling (e.g., accurately identifying a specific format of ID number and marking it as L1 sensitive data under a certain standard and specification) is valuable prior knowledge for other tenants facing similar data identification challenges. Unfortunately, traditional sensitive data identification schemes fail to effectively utilize these valuable knowledge assets scattered across different tenants, forcing each tenant to accumulate experience from scratch and repeatedly perform a large amount of manual verification and label correction work. That is, the overall efficiency of sensitive data identification is low, while also increasing the tenant's own operating costs. Furthermore, attempting to directly utilize the labeling knowledge of other tenants to optimize the current tenant's sensitive data identification results carries the risk of leaking the original sensitive data.

[0004] Therefore, how to break down data tag knowledge silos and achieve cross-tenant tag knowledge sharing while strictly protecting the data privacy and security of each tenant has become a technical problem that needs to be solved. Summary of the Invention

[0005] This application provides a method, apparatus, computing device cluster, computer program product, and computer-readable storage medium for identifying sensitive data, which breaks down data tag knowledge silos and enables cross-tenant tag knowledge sharing while ensuring the data privacy and security of each tenant.

[0006] Firstly, a method for identifying sensitive data is provided. This method is applied to a data management system, which includes at least one shared tag knowledge base. The shared tag knowledge base includes tags for sensitive data belonging to multiple tenants. Each tenant's sensitive data tag includes encrypted data, hierarchical information, and classification information. The encrypted data is obtained by encrypting the feature vector of the contextual information of the tenant's sensitive data. The method includes: receiving a first request message from a target tenant, the first request message indicating an identification task, the first request message including first indication information and second indication information, the first indication information indicating a target data source, and the second indication information indicating enabling tag sharing functionality; identifying sensitive data in the target data source according to the first request message and obtaining an initial tag for the target sensitive data, the initial tag including the contextual information of the target sensitive data; in response to the second indication information, extracting features from the contextual information of the target sensitive data in the initial tag and encrypting the extracted feature vector to obtain a query vector; searching for encrypted data matching the query vector in the at least one shared tag knowledge base according to a vector search algorithm to obtain at least one candidate tag; and determining the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate tag.

[0007] Based on the above technical solution, this application constructs a shared tag knowledge base. This shared tag knowledge base includes tags for sensitive data from multiple tenants. Each tenant's sensitive data tag includes encrypted data after extracting feature vectors from the context information of the sensitive data and encrypting them. Subsequently, encrypted vector search technology is used to search for matching encrypted data in this shared tag knowledge base. This enables the system to complete vector search within the encrypted domain, ensuring that the tenant's original sensitive data does not leave its security boundary, resolving the contradiction between cross-tenant tag knowledge sharing and data privacy protection, and achieving data usability without visibility. In other words, the solution provided in this application breaks down the tag knowledge barrier of a single tenant, reduces the workload of manual review and tagging, and significantly improves the accuracy and consistency of sensitive data classification.

[0008] In other words, the solution provided in this application allows tenants to choose to enable relevant functions when creating sensitive data identification tasks. This enables them to automatically optimize their own scanning results by leveraging the tag knowledge shared by other tenants, effectively solving the problem of tag information silos and improving identification accuracy. Furthermore, by implementing encrypted storage and retrieval, it ensures that the original sensitive data content is not leaked while knowledge is shared, balancing the needs of knowledge sharing and privacy protection.

[0009] In conjunction with the first aspect, in one possible implementation, the first request message further includes third indication information, which is used to indicate the target industry attribute corresponding to the identification task. According to the vector search algorithm, encrypted data matching the query vector is searched in at least one shared tag knowledge base to obtain at least one candidate tag, including: according to the vector search algorithm and the third indication information, encrypted data matching the query vector is searched in at least one shared tag knowledge base to obtain at least one candidate tag, wherein the industry attribute to which each candidate tag belongs matches the target industry attribute.

[0010] Based on the above technical solution, this application considers that different industries (such as finance and healthcare) often have significant differences in their classification standards for sensitive data. This application uses industry attributes as a filtering condition, allowing the subsequent system to prioritize industry tags under the same or similar standards. This effectively resolves conflicts arising from differences in classification standards across tenants and industries, avoids incorrect matching, and makes the final tag assignment results more in line with the specific industry's requirements, thus improving the accuracy of tag matching.

[0011] In conjunction with the first aspect, in one possible implementation, the label of each tenant's sensitive data also includes permission information, which is used to indicate which tenants are allowed to access the label. According to the vector search algorithm, the encrypted data matching the query vector is searched in at least one shared label knowledge base to obtain at least one candidate label, including: according to the vector search algorithm and the permission information, the encrypted data matching the query vector is searched in at least one shared label knowledge base to obtain at least one candidate label, and the permission information in each candidate label is used to indicate which target tenants are allowed to access the candidate label.

[0012] Based on the above technical solution, this application introduces permission information into the sensitive data tags of each tenant, realizing absolute logical security isolation and controllable sharing of cross-tenant tag knowledge. Through this permission information, the system can accurately control and verify which specific tenants are qualified to access and reuse a tenant's shared prior tag resources, preventing unauthorized abuse of sensitive tag knowledge.

[0013] In conjunction with the first aspect, in one possible implementation, the data management system further includes a local tag knowledge base of the target tenant. The local tag knowledge base of the target tenant includes tags for at least one sensitive data of the target tenant. The tags for the sensitive data of the target tenant include the following information: encrypted data, hierarchical information, classification information, permission information, and rule information. The rule information is used to indicate the identification rules for sensitive data. Based on at least one candidate tag, the hierarchical information and / or classification information of the target sensitive data are determined, including: based on at least one candidate tag, the local tag knowledge base of the target tenant, and the rule information, the hierarchical information and / or classification information of the target sensitive data are determined.

[0014] Based on the above technical solution, this application combines the candidate tags obtained from the shared tag knowledge base with the target tenant's local tag knowledge base for comprehensive consideration. This not only significantly reduces the workload of manual tagging and manual review, but also ensures that the automatically assigned hierarchical classification tags have both high accuracy and reliability, and can meet the specific tenant's personalized and stringent data security and compliance requirements.

[0015] In conjunction with the first aspect, in one possible implementation, the hierarchical information and / or classification information of the target sensitive data are determined based on at least one candidate label, the target tenant's local label knowledge base, and rule information. This includes: determining that the initial label of the target sensitive data does not include rule information; determining the rule information of the target sensitive data based on the rule information of at least one candidate label, wherein the rule information of the target sensitive data is the same as the rule information in a candidate label; searching for rule information matching the rule information of the target sensitive data in the target tenant's local label knowledge base according to a matching algorithm to obtain a target label, wherein the matching degree between the rule information in the target label and the rule information of the target sensitive data is greater than or equal to a first threshold; and determining the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the target label.

[0016] Based on the above technical solution, in this application, when the initial scan fails to fully identify the rule information, the system can first use high-scoring candidate tags from the shared tag knowledge base to complete the missing rule attributes, and then switch back to the target tenant's local tag knowledge base for secondary precise matching. This implementation method not only eliminates the identification blind spot caused by the omission of initial rules, but also ensures that the final assigned hierarchical classification tags can give priority to the tenant's historical successful experience, making the tag assignment process more reasonable. Thus, while improving the success rate of automated correction, it ensures that the tag optimization results not only comply with industry standards, but also perfectly meet the actual personalized business needs of specific tenants.

[0017] In conjunction with the first aspect, in one possible implementation, the hierarchical information and / or classification information of the target sensitive data are determined based on at least one candidate label, the target tenant's local label knowledge base, and rule information. This includes: determining the initial label of the target sensitive data, which includes rule information; determining a first matching degree between each candidate label and the initial label according to a matching algorithm; and determining the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information.

[0018] For example, the first matching degree between each candidate tag and the initial tag is obtained based on the second matching degree between the candidate tag and the initial tag, and the third matching degree between the candidate tag and the initial tag. The second matching degree is the matching degree between the context information of the sensitive data of the candidate tag and the query vector, and the third matching degree is the matching degree between the rule information of the candidate tag and the rule information of the initial tag.

[0019] Based on this implementation, when the initial tags already contain rule information, the system calculates the first matching degree with candidate tags in the shared knowledge base to introduce prior experience for similarity verification. Then, it combines this matching degree with the target tenant's local tag knowledge base for final confirmation. This approach combines globally shared knowledge with local historical success experience, effectively resolving conflicts arising from inconsistencies in standards across tenants or industries, prioritizing the accuracy of specific business specifications for the tenant, and significantly reducing the workload of manual tagging and review. Ultimately, it ensures that the automatically assigned hierarchical classification tags possess both high reliability and consistency, while also guaranteeing the personalized data security and compliance needs of specific tenants.

[0020] In conjunction with the first aspect, in one possible implementation, the hierarchical information and / or classification information of the target sensitive data are determined based on a first matching degree between each candidate tag and the initial tag, the target tenant's local tag knowledge base, and rule information. This includes: determining filtered candidate tags based on a first matching degree and a second threshold between each candidate tag and the initial tag, wherein the first matching degree between the filtered candidate tags and the initial tag is greater than or equal to the second threshold; obtaining rule information of the target sensitive data based on the rule information of the filtered candidate tags, wherein the rule information of the target sensitive data is the same as the rule information of a filtered candidate tag; searching for rule information similar to the rule information of the target sensitive data in the target tenant's local tag knowledge base to obtain a target tag, wherein the matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to the first threshold; and determining the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the target tag.

[0021] Based on the above technical solution, in this application, the system can first use the high similarity candidate tags of the shared knowledge base to determine the rule information, and then switch back to the target tenant's local tag knowledge base to extract the final hierarchical and classification information. That is, it gives priority to the tenant's historical successful experience, making the tag assignment process more reasonable, and also ensuring that the final optimized tag results can perfectly match the actual business needs and security compliance of the specific tenant, thereby greatly reducing the workload of manual review and manual tag determination, which not only improves the accuracy rate, but also ensures personalized matching.

[0022] In conjunction with the first aspect, in one possible implementation, the hierarchical information and / or classification information of the target sensitive data are determined based on a first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information. This includes: determining that the first matching degree between each candidate label and the initial label is less than or equal to a second threshold and greater than or equal to a third threshold; sending suggestion information, which indicates the hierarchical information and / or classification information recommended for the target sensitive data; receiving feedback information, which indicates the hierarchical information and / or classification information of the target sensitive data to be manually confirmed; and determining the hierarchical information and / or classification information of the target sensitive data based on the feedback information.

[0023] Based on the above technical solution, in this application, when the system determines that the confidence level of automated correction is insufficient for direct replacement, a semi-automatic suggestion is triggered by setting a specific similarity interval and then submitted for manual confirmation. This mechanism effectively avoids the matching error risk that full automation may introduce in such uncertain scenarios. This approach fully utilizes the cross-tenant shared knowledge base (such as combining industry attributes, historical accuracy, and other heuristic rules) to provide users with high-quality correction references while securely retaining the final decision-making power to the tenant, thereby strongly guaranteeing the accuracy of label processing in critical and sensitive data scenarios.

[0024] In conjunction with the first aspect, in one possible implementation, the hierarchical information and / or classification information of the target sensitive data are determined based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information. This includes: determining that the first matching degree between each candidate label and the initial label is less than or equal to a third threshold; and determining the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the initial label of the target sensitive data.

[0025] Based on the above technical solution, in this application, when the tags recommended in the shared tag knowledge base are extremely mismatched with the current business context, it can decisively intercept and discard misleading suggestions with low relevance, and directly retain the results of the tags initially identified locally. This not only effectively avoids the risk of serious matching errors caused by forcibly applying irrelevant shared tags, but also ensures the accuracy of the automated hierarchical classification system for sensitive data.

[0026] In conjunction with the first aspect, in one possible implementation, the method further includes: storing the hierarchical information and / or classification information of the target sensitive data in the target tenant's local tag knowledge base.

[0027] Based on the above technical solution, in this application, by saving the verified high-quality labels back to the local machine, the tenant not only establishes a private experience library that conforms to its own business specifications, but the system can also use these continuously accumulated historical successful correction data to continuously optimize the heuristic correction algorithm, thereby executing the label correction process more efficiently in the future.

[0028] In conjunction with the first aspect, in one possible implementation, the method further includes: receiving a second request message from a target tenant, the second request message including fourth indication information, the fourth indication information being used to indicate a target data source; identifying sensitive data in the target data source according to the second request message, and obtaining an initial label for the target sensitive data, the initial label including contextual information of the target sensitive data; searching for labels similar to the initial label of the target sensitive data in the target tenant's local label knowledge base according to a similarity algorithm, obtaining similar labels, the similarity between the similar labels and the initial labels being greater than or equal to a fourth threshold; and obtaining hierarchical information and / or classification information of the target sensitive data based on the similar labels.

[0029] Based on the above technical solution, in this application, by using the target tenant's exclusive local tag knowledge base for high-threshold similarity matching, the system can maximize the use of the tenant's historically accumulated successful experience and improve the efficiency of automatic identification of sensitive data.

[0030] It should be noted that the beneficial effects achieved by each implementation method in the following aspects can be understood by referring to the relevant implementation methods in the first aspect above, and will not be repeated here.

[0031] In a second aspect, an apparatus for identifying sensitive data is provided. For example, the apparatus may include units and / or modules for performing the method proposed in this application, such as a configuration interface module, a scanning module, and a correction module, which can be used to perform the method of the first aspect described above.

[0032] For example, the device may be a server, a server cluster, or the infrastructure that provides cloud services in a cloud service system.

[0033] For example, the device can be a virtual instance, such as a virtual machine, a container, a bare metal server, etc.

[0034] Thirdly, this application provides an apparatus comprising: at least one processor for executing a computer program or instructions stored in a memory to perform the method described in the first aspect. Optionally, the apparatus further comprises a memory for storing the computer program or instructions. Optionally, the apparatus further comprises a communication interface through which the processor reads the computer program or instructions stored in the memory.

[0035] In one implementation, the device is a means for implementing the functions of the above-described method in a chip.

[0036] In another implementation, the device is a chip, chip system, or circuit used to implement the functions of the above methods in a chip.

[0037] Fourthly, this application provides a processor, including: an input circuit, an output circuit, and a processing circuit. The processing circuit is used to receive signals through the input circuit and to transmit signals through the output circuit, causing the processor to execute the method described in the first aspect.

[0038] In specific implementation, the processor can be one or more chips, the input circuit can be input pins, the output circuit can be output pins, and the processing circuit can be transistors, gate circuits, flip-flops, and various logic circuits. The input signals received by the input circuit can be received and input via, for example, but not limited to, a communication interface. The signals output by the output circuit can be output to, for example, but not limited to, a communication interface and transmitted by the communication interface. Furthermore, the input circuit and the output circuit can be the same circuit, which is used as both the input and output circuits at different times. This application does not limit the specific implementation of the processor and various circuits.

[0039] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0040] Fifthly, a computing device is provided, including a processor and a memory. The processor is used to read instructions stored in the memory and to receive and send data via a communication interface to execute the method described in the first aspect.

[0041] Optionally, the processor may be one or more, and the memory may be one or more.

[0042] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0043] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0044] Specifically, the data output by the processor can be sent to the communication interface, and the input data received by the processor can come from the communication interface.

[0045] The computing device mentioned in the fifth aspect above can be one or more chips. The processor in the computing device can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0046] In a sixth aspect, a computing cluster is provided, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, such that the computing device cluster performs the method described in any possible implementation of the first aspect.

[0047] Optionally, the processor can be a general-purpose processor, which can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc.; when implemented in software, the processor can be a general-purpose processor that reads software code stored in memory. This memory can be integrated into the processor or located outside the processor and exist independently.

[0048] In a seventh aspect, a computer-readable storage medium is provided, the computer-readable storage medium including computer program instructions, which, when executed by a cluster of computing devices, are used to perform the method of the first aspect described above.

[0049] Eighthly, a computer program product including instructions is provided, which, when run by a cluster of computing devices, cause the cluster of computing devices to perform the method of the first aspect described above.

[0050] Ninthly, a chip system is provided, comprising a processor and a power supply circuit. The power supply circuit supplies power to the processor, which executes the operation steps corresponding to the method described in the first aspect or any implementation thereof. For brevity, further details are omitted here. The processor can be implemented using a graphics processing unit (GPU), or a data processing unit (DPU), neural network processing unit (NPU), heterogeneous processing unit (XPU), system-on-chip (SoC), offload card, accelerator card, or other computing devices.

[0051] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0052] Figure 1 This is a schematic flowchart illustrating a method 100 for identifying sensitive data according to an embodiment of this application.

[0053] Figure 2 This is another schematic diagram illustrating a method for identifying sensitive data according to an embodiment of this application.

[0054] Figure 3 This is a schematic flowchart illustrating a method 300 for identifying sensitive data according to an embodiment of this application.

[0055] Figure 4 This is another illustrative flowchart illustrating a method for identifying sensitive data as shown in the embodiments of this application.

[0056] Figure 5 This is a schematic diagram of a cloud service system architecture to which this application applies.

[0057] Figure 6 This is a schematic block diagram of a device 600 for identifying sensitive data, as shown in an embodiment of this application.

[0058] Figure 7 This is a schematic block diagram of a computing device 700 shown in an embodiment of this application.

[0059] Figure 8 This is a schematic diagram of the architecture of a computing device cluster shown in an embodiment of this application.

[0060] Figure 9 This is a schematic diagram illustrating the connection between computing devices 800A and 800B via a network, as shown in an embodiment of this application. Detailed Implementation

[0061] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0062] To facilitate understanding of the technical solutions provided in the embodiments of this application, the technical terms involved in this application are briefly introduced below. It should be noted that the introduction of technical terms in this application is only for the purpose of helping to understand the technical solutions and should not be construed as limiting the application.

[0063] 1. Embedding "Embedded vector" (or simply vector) technology originated in the field of natural language processing, but it is now widely used in many fields such as recommender systems, computer vision, and knowledge graphs. Its core idea is to learn a mapping function to map discrete symbolic data into a low-dimensional continuous vector space, so that semantically similar symbolic data have similar vector representations in this vector space. This mapping function is usually learned through neural networks. Generally, an embedded vector can be understood as representing an object with a low-dimensional, dense vector; objects with low similarity typically have a large distance between their embedded vectors.

[0064] 2. Vector retrieval In retrieval-augmented generation (RAG) systems, vector retrieval is a key technology for achieving efficient information retrieval. For example, it can first transform text data into high-dimensional vectors, and then quickly locate data semantically similar to the user's query in a massive corpus by calculating the similarity between the vectors. Based on the relevant information obtained from vector retrieval, RAG combines it with a generative model to integrate and generate content, ensuring that the generated answers are both targeted and fully utilize corpus knowledge. This effectively improves the response quality and efficiency of the RAG system, providing users with more accurate and useful information.

[0065] 3. Approximate nearest neighbor (ANN) query A typical application of vector queries in RAG is the approximate nearest neighbor (ANN) query. The main goal of the approximate nearest neighbor is to find the k vectors in a given vector knowledge base that have the highest similarity to the query vector. The simplest method is to calculate the exact distance between each vector in the dataset and the query, but this method is very time-consuming when the dataset is large. Therefore, various vector indexes have been developed to accelerate the search process.

[0066] A vector index can be understood as a data structure used to efficiently search and retrieve similar vectors in a high-dimensional vector space. For example, a vector index includes the following: (1) Index structure: different index structures have different characteristics, such as tree structure, hash table, graph structure, etc.; (2) Metadata: metadata related to each vector, such as vector identifier, label or other descriptive information, which is very useful in the retrieval results; (3) Vector data: the index can point to the actual vector data. For example, the vector data can be embedded in the index structure, in which case the vector index can directly store the vector values. Alternatively, it can be stored externally, in which case the vector index only stores the vector identifier. Currently, the most commonly used vector indexes in the industry are inverted file (IVF) indexes and graph indexes (e.g., hierarchical navigable small world (HNSW) and disk approximate nearest neighbor search algorithm (DiskANN)).

[0067] 4. Sensitive data Sensitive data can be understood as any data that, if leaked, illegally provided, or misused, may cause material, psychological, economic, or reputational damage to personal privacy, core corporate interests, or national security. For example, in actual business and cloud service scenarios, it typically includes various types of personal identification information (e.g., name, ID number, license plate number), financial data, and medical records, as well as internal organizational trade secrets, proprietary agreements, or core technical information. Due to its extremely high potential risks, this type of data must be protected through strict classification and grading mechanisms (e.g., classified as L1-L4 or confidential / top secret levels) with differentiated encryption, logical isolation, and compliance auditing throughout its entire lifecycle.

[0068] 5. Labels for sensitive data For example, sensitive data tags can be understood as metadata used to identify and manage sensitive data. They can be thought of as "electronic tags" or "tiered classification labels" affixed to sensitive data, forming the basis for data security scanning, asset inventory, and the application of protection strategies. For instance, a standard sensitive data tag typically contains two core dimensions: ① Classification: Indicates the type of data, answering the question "What kind of data is this?" (e.g., name, ID number, bank card number, license plate number, medical terminology, etc.). ② Tier: Indicates the sensitivity or importance level of the data, answering the question "How sensitive / important is this?" (e.g., L1, L2, L3, L4, or internal, secret, confidential, top secret, etc.).

[0069] For example, the structure of a complete sensitive data tag may include the following: ① Rule information: This refers to the name of the identification rule or strategy that was hit during scanning. For example, it could be a name. ② Hierarchical information: This indicates the sensitivity level of the data, typically classified as L1, L2, L3, L4, or confidential, top secret, etc. ③ Classification information: This indicates the specific type of data, such as name, ID number, license plate number, etc. Hierarchical and classification information together constitute the basic metadata for data security management. ④ Hit entity: This refers to the sensitive data scanned according to the rule information. For example, the entity obtained by scanning according to the name rule could be "Zhang San". ⑤ Context information: This represents the actual sensitive data scanned (i.e., the hit entity) and its complete context, i.e., the hit context. For example, it could be "Zhang San applied for a new patent this year".

[0070] For example, the label for sensitive data could be as follows: Hitting rule: "Name", Hitting entity: "Zhang San", Hitting context: "Zhang San applied for a new patent this year", Preliminary classification: L1, Preliminary category: "Name".

[0071] 6. Multi-tenancy environment With the popularization of cloud computing technology, multi-tenant architecture has become the mainstream mode of cloud service delivery. Under this architecture, the hardware and software resources of a single service instance are shared by multiple tenants (i.e., customers or users) to achieve intensive resource utilization and cost reduction, thus realizing a multi-tenant environment. A multi-tenant environment can be understood as a single software instance or service being able to provide services to multiple customers (i.e., "tenants") simultaneously, with each tenant's data and configuration logically isolated from one another. For example, in the scenario of this application, it can also be understood as a cloud service scenario (e.g., applicable to a single software instance on-premises), where different enterprises or users (such as tenant #A and tenant #B) share the same data security scanning platform, but their sensitive data tag information is isolated by default.

[0072] Typically, data security, as the cornerstone of cloud services, hinges on the identification and classification of sensitive data. Traditional data security solutions are often designed in a single-tenant model, where each tenant's data identification and labeling processes operate independently and in isolation. However, in multi-tenant cloud environments or multi-user systems, this isolation model has significant limitations. While different tenants may have different business domains and data content, they often share commonalities in their data classification and grading standards (e.g., the definition and grading of personal identification information, financial data, and health information) and adhere to similar industry standards or regulatory requirements. The valuable experience accumulated by one tenant in data identification and labeling (e.g., accurately identifying a specific format of ID number and marking it as L1 sensitive data under a certain standard and specification) provides valuable prior knowledge for other tenants facing similar data identification challenges. Unfortunately, traditional sensitive data identification solutions fail to effectively utilize these valuable knowledge assets scattered across different tenants, forcing each tenant to accumulate experience from scratch and repeatedly perform extensive manual verification and label correction work. In other words, the overall efficiency of sensitive data identification is low, while also increasing the tenant's own operating costs. Meanwhile, attempting to directly leverage other tenants' tag knowledge to optimize the current tenant's sensitive data identification results carries the risk of leaking the original sensitive data. Therefore, how to break down data tag knowledge silos and achieve cross-tenant tag knowledge sharing while strictly protecting the data privacy and security of each tenant has become a technical problem that needs to be solved.

[0073] In view of this, this application provides a method for identifying sensitive data, constructing a shared tag knowledge base. This shared tag knowledge base includes tags for the sensitive data of multiple tenants. Each tenant's sensitive data tag includes encrypted data after extracting feature vectors from the context information of the sensitive data and encrypting them. Subsequently, encrypted vector search technology is used to search for matching encrypted data in the shared tag knowledge base. This enables the system to complete vector search within the encrypted domain, ensuring that the tenant's original sensitive data does not leave its security boundary, resolving the contradiction between cross-tenant tag knowledge sharing and data privacy protection, and achieving data usability without visibility. In other words, the solution provided in this application breaks down the tag knowledge barrier of a single tenant, reduces the workload of manual review and labeling, and significantly improves the accuracy and consistency of sensitive data classification.

[0074] Figure 1 This is a schematic flowchart of a method 100 for identifying sensitive data provided in this application. The following is a summary of the flowchart. Figure 1 The technical solution of this application is described in detail.

[0075] For example, the method provided in this application can be applied to a data management system that includes at least one shared tag knowledge base. In this application, the at least one shared tag knowledge base includes tags for sensitive data belonging to multiple tenants, and each tenant's sensitive data tag includes at least encrypted data (denoted as C), hierarchical information (denoted as L), and classification information (denoted as F).

[0076] In one possible implementation, the shared tag knowledge base is centrally configured. This can be understood as multiple tenants corresponding to the same shared tag knowledge base; that is, tags for sensitive data that each tenant agrees to share can be stored in this centralized shared tag knowledge base. For example, in this centralized implementation, there can be one or multiple shared tag knowledge bases. For instance, a separate shared tag knowledge base can be built for different industries, with each shared tag knowledge base storing only the tags for the sensitive data of multiple tenants related to that industry. Alternatively, only one shared tag knowledge base can be built, in which case it can include tags for the sensitive data of various tenants from different industries.

[0077] In another possible implementation, the shared tag knowledge base is a decentralized peer-to-peer network architecture. This can be understood as each tenant having its own shared tag knowledge base (i.e., multiple shared tag knowledge bases can be included, with each tenant having its own locally configured shared tag knowledge base). This shared tag knowledge base only stores tags for sensitive data that the tenant agrees to share. Therefore, in this application, the shared tag knowledge base can be a centralized or logically unified sensitive data tag knowledge base; it can also adopt a fully decentralized peer-to-peer network architecture. In this case, tenants can directly perform encrypted tag queries and exchanges without relying on a central shared tag knowledge base. For example, this deployment method may be more suitable for scenarios where centralized architecture is distrusted or where network latency requirements are extremely high, while still achieving the goal of cross-tenant tag knowledge sharing.

[0078] In this application, the encrypted data is obtained by encrypting the feature vector of the contextual information of the tenant's sensitive data. For example, the encrypted data represents the feature vector transformed from the actually scanned sensitive data (i.e., the hit entity) and its complete context (i.e., the hit context). To absolutely protect the data privacy of each tenant, this vector is stored encrypted (e.g., using searchable symmetric encryption (SSE) technology). This allows the data to be used by other tenants for similarity calculation and matching without exposing the plaintext.

[0079] For example, encrypted data can also be understood as a set of segmented vectors representing the context of sensitive words. Specifically, it can be understood as the data security scanning module automatically extracting the plaintext context (e.g., contextual information) surrounding a specific sensitive data entity (such as an ID card number or card number) when it encounters that entity. Natural language processing (NLP) techniques are then used to desensitize and segment this context sequence, and a deep pre-trained language model (such as BERT) is used to map the segmented sequence to a high-dimensional continuous vector space, ultimately generating a dense set of feature vectors. The following describes a method for obtaining encrypted data from the tags of sensitive data.

[0080] In one possible implementation, firstly, when the scanning module connects to and scans the target data source, if it encounters rule information related to sensitive data, it automatically extracts the plaintext sentences before and after the sensitive words using natural language processing technology and segments them into independent word groups, which can be understood as the "word segmentation" stage of desensitization. Next, the system inputs these word groups into a pre-trained deep learning model (such as BERT) for semantic analysis, mapping the abstract language environment into a string of machine-readable high-dimensional mathematical numerical features, which is a "vector". Subsequently, all context feature vectors representing the specific business context are combined to obtain an indivisible feature "set". Finally, in order to achieve cross-tenant privacy protection, before persisting the set to the knowledge base, encryption technology can be used to process it into ciphertext, resulting in ciphertext that cannot be reversed to the original privacy and can be directly compared using cosine distance mathematical comparison within the encrypted domain, i.e., encrypted data.

[0081] For example, the system scans the text and finds the sentence: "Customer Zhang San (ID number: 510108xxxx0316xxxx)'s housing provident fund contribution record is normal." Here, "510108xxxx0316xxxx" is identified as sensitive data. The words before and after it, "customer..." and "the housing provident fund contribution record is normal," form its context. Afterwards, it can be converted into a vector set. The system will not directly save the plaintext above, as this would leak privacy. It will perform two steps using natural language processing and deep learning models such as BERT: ① Word segmentation and desensitization: replacing names and ID numbers with placeholders; ② Segmenting into phrases: ["customer", "[name]", "of", "housing provident fund", "contribution", "transaction record", "normal"]. ③ Vectorization: using a semantic model, these phrases are converted into a high-dimensional mathematical feature array (i.e., a vector). For example, in the system, the encrypted data is a high-dimensional feature vector representing the semantic context of "bank customer checking housing provident fund transaction history". For example, it could be the following: [0.1254, -0.4851, 0.9962, ..., 0.0124].

[0082] It should be noted that this application does not limit the specific encryption technology used. For example, different encryption technologies such as searchable symmetric encryption, homomorphic encryption, secure multi-party computation, or differential privacy can be used to encrypt the vector. For instance, homomorphic encryption can be used to directly calculate similarity on the ciphertext, or secure multi-party computation can be used to enable multiple tenants to collaboratively compute the optimal label without exposing their individual inputs.

[0083] Furthermore, the sensitive data tags for each tenant also include permission information, which indicates which tenants are allowed to access the tag. This can also be understood as the tag including access control attributes, specifying which other tenants are authorized to access and use the shared tag experience. For example, a tenant can specify a particular tenant ID, or configure a wildcard "*" to indicate full access for all tenants. For instance, a whitelist approach can be used for access control. Alternatively, methods such as identity and access management (IAM) tenant identity or role-based access control (RBAC) can also be used.

[0084] In this application, permission information (such as access control whitelists, IAM identities, or RBAC role attributes) is introduced into the sensitive data tags of each tenant, achieving absolute logical security isolation and controllable sharing of cross-tenant tag knowledge. Through this permission information, the system can precisely control and verify which specific tenants are qualified to access and reuse a tenant's shared prior tag resources, effectively preventing unauthorized abuse of sensitive tag knowledge.

[0085] In this application, the hierarchical information is used to characterize the sensitivity level of the tenant's sensitive data, and the classification information is used to characterize the type of the tenant's sensitive data.

[0086] Furthermore, the sensitive data label for each tenant also includes rule information, which indicates the identification rules for the sensitive data. For example, this rule information may include at least one of the following: a rule name (denoted as R) and / or a set of segmented vectors of the rule name (denoted as Rv). For instance, the rule name can be understood as the name of the identification rule or strategy hit during scanning. For example, it could be "name" or "ID number," representing a specific rule type used in the system to visually identify the hit sensitive data. For example, the set of segmented vectors of the rule name, also called rule vectors, is the set of "rule names" after natural language processing (e.g., word segmentation) and transformation into mathematical vectors. For example, taking "name" or "ID number" as an example, the system uses pre-trained models such as BERT at the underlying level to perform word segmentation and semantic analysis on these rule text contents, and transforms them into a multi-dimensional vectorized representation.

[0087] The tag structure (encrypted data, hierarchical information, classification information, permission information, and rule information) provided in this application ensures logical isolation and secure sharing of tag information. In this application, at least one shared tag knowledge base can be pre-built; that is, each tenant can store the tags of its agreed-upon shared sensitive data in this knowledge base according to the aforementioned tag structure, facilitating subsequent searches by other tenants within this shared tag knowledge base.

[0088] 110, Receive the first request message from the target tenant, which is used to instruct the identification task.

[0089] In this application, the first request message includes first instruction information and second instruction information. The first instruction information indicates the target data source, and the second instruction information indicates that the tag sharing function should be enabled. This can also be understood as the target tenant configuring the identification task on a configuration interface.

[0090] For example, the target data source can be understood as the target storage system specified by the tenant that contains sensitive data to be scanned and identified. That is, the sensitive data scanning module will connect to and scan these data sources to identify sensitive data fragments according to the configured policies and task instructions.

[0091] For example, the target data source can be at least one of the following: ① Object Storage Service (OBS): a cloud storage service used to store unstructured data. ② Relational Database Service (RDS): a database service used to store structured business data. ③ Log Service: a data source used to collect and manage system operation logs. ④ Big Data Database / Big Data: a large-scale distributed data storage and computing system. ⑤ File System: a physical or logical storage system for storing files and documents in a tenant's environment. In this application, in actual business processes, tenants (such as financial institutions and medical institutions) can flexibly configure, select, and connect to these different types of data sources on the user interface to perform automated data classification, grading, and security governance according to their own asset inventory needs.

[0092] For example, tenant #C logs into the service provider's data security center system and accesses the identification task creation interface. During task configuration, tenant #C needs to explicitly check the "Enable Tag Sharing" button on the "Scan Task Configuration Page." The rule or level configuration interface provides a switch that allows tenants to share their configured industry-specific hierarchical classification tag rules with others. For instance, from a physical implementation perspective, this configuration interface runs on the service provider's application server, providing a graphical interface to tenant #C via a web service. When tenant #C clicks the confirmation button, the configuration information is encapsulated into a JavaScript object notation (JSON) request message and transmitted to the backend task management module via Hypertext Transfer Protocol Secure (HTTPS).

[0093] For example, to encourage sharing, it can be configured so that only users who have enabled the "Enable Tag Sharing" button can configure the "Enable Heuristic Correction Algorithm" switch, that is, only then can they execute the heuristic correction process in step 150 below.

[0094] In one possible implementation, the first request message also includes third indication information, which indicates the target industry attribute corresponding to the identification task. For example, when configuring the identification task, the user can configure the industry attribute of the scanning template. This allows the subsequent label matching to filter out the influence of irrelevant industry classification labels. Considering that different industries (such as finance and healthcare) often have significantly different classification standards for sensitive data, this application uses industry attributes as a filtering condition. The subsequent system can prioritize industry labels under the same or similar standards, effectively resolving conflicts caused by differences in classification standards across tenants and industries, avoiding incorrect matching, and making the final label assignment results more in line with the specific industry's requirements, thus improving the accuracy of label matching.

[0095] 120. Based on the first request message, identify sensitive data in the target data source and obtain the initial label of the target sensitive data.

[0096] In this application, the initial label includes contextual information about the target sensitive data.

[0097] For example, in this application, initial labels for multiple target sensitive data were obtained by scanning the target data source.

[0098] For example, after receiving a task execution instruction, the scanning module first connects to the data source specified by tenant #C based on the task configuration information. This data source could be an object storage service, a database instance, or a file system, etc. The scanning module then scans for sensitive data in this data source according to a preset scanning strategy. For instance, each data shard goes through a sensitive data identification pipeline, which includes three main stages: pattern matching based on regular expressions, semantic analysis based on machine learning models, and logical judgment based on predefined rules.

[0099] For example, in the pattern matching stage, the scanning module loads the tenant's custom recognition rules and the system's pre-defined general rules (e.g., industry attributes) to quickly match the data content. For successfully matched data items, the system subsequently generates preliminary recognition results containing location information, matching rule IDs, and confidence scores. For example, in the semantic analysis stage, the system uses pre-trained models such as BERT to vectorize the data content and then uses a neural network classifier to determine whether the data belongs to sensitive data types. Furthermore, the model can also assign confidence scores to the recognition results. For example, in the logical judgment stage, the system integrates the results of the first two stages and applies algorithms such as decision trees to generate the final preliminary labels. Specifically, the specific implementation method of the system scanning sensitive data in the target data source and obtaining the labels of each sensitive data point can be understood by referring to existing publicly available methods, and will not be detailed in this application.

[0100] For example, the structure of the initial label of one of the target sensitive data obtained in this step is as follows: Hit rule: "Name", Hit entity: "Zhang San", Hit context: "Zhang San applied for a new patent this year", Preliminary classification: L1, Preliminary category: "Name", Confidence score: 0.8.

[0101] 130. In response to the second instruction information, feature extraction is performed on the context information of the target sensitive data in the initial label, and the extracted feature vector is encrypted to obtain the query vector.

[0102] For example, after obtaining the initial identification results, the system checks whether tenant #C has enabled the tag sharing function. If the flag is enabled, the system initiates the encrypted vector search process. For instance, the system uses vector encryption technology to extract features from the context information of the sensitive target data to be queried and encrypts it, ensuring that tenant #C's original data does not leave its security boundary in plaintext. The encrypted vector query request is then sent to the search interface of the shared tag knowledge base for a searchable encrypted query.

[0103] 140. Based on the vector search algorithm, search for encrypted data that matches the query vector in at least one shared tag knowledge base to obtain at least one candidate tag.

[0104] In this application, "matching" can be understood as a generalized intelligent association and optimization process performed by the system to find the most relevant prior labels to correct the current recognition result. For example, this can be accomplished using similarity algorithms (e.g., ANNs). Alternatively, graph neural networks can be used (e.g., constructing a knowledge graph of labels and their relationships, and finding similar labels through graph matching or graph embedding). Still other alternatives include more complex deep learning models (such as those based on Transformers to capture contextual relationships). This application does not limit the specific sampling method used to obtain the encrypted matching data or the matched labels.

[0105] Correspondingly, in this application, "matching degree" can be understood as a specific score or indicator used by the system to quantitatively evaluate the strength of the association between the current target sensitive data and the prior candidate labels in the shared knowledge base. For example, if the matching algorithm is a similarity algorithm, the matching degree can be the similarity score. For example, if the matching algorithm uses a deep learning model such as a graph neural network or Transformer, the "matching degree" here is represented by the association score of the graph topology matching or the semantic probability confidence of the model output. For ease of understanding, in the following specific embodiments, the matching algorithm is mainly described using a similarity algorithm as an example.

[0106] In one possible scenario, the shared tag knowledge base maintains vector indexes of tags from sensitive data across multiple tenants; these indexes are also stored in encrypted form. For example, upon receiving a query request, the shared tag knowledge base's search module performs an approximate nearest neighbor search algorithm within the encrypted domain to find a set of candidate tags (e.g., TOP3, TOP5, etc.) that best match the query vector. For instance, the entire search process is implemented using searchable encryption, ensuring that the knowledge base or third parties cannot know the specific query content, and that tenant #C cannot directly access other tenants' original tag data. After the search is complete, the shared tag knowledge base returns tag information, i.e., at least one candidate tag.

[0107] In one possible implementation, if the first request message also carries third indication information, then, based on the vector search algorithm and the third indication information, encrypted data matching the query vector can be searched in at least one shared tag knowledge base to obtain at least one candidate tag, wherein the industry attribute to which each candidate tag belongs matches the target industry attribute.

[0108] This can also be understood as the system providing an industry-attribute-based filtering mechanism when performing cross-tenant sensitive data tag matching. Specifically, when configuring a recognition task, users can explicitly specify the target industry attribute of the scanning task or template through third-party instructions. When the system performs vector-encrypted search within the vast shared tag knowledge base, it uses this industry attribute as a key filtering condition to specifically match and recall candidate tag data belonging to the same industry standards or similar backgrounds as the current business. This approach not only directly filters out interference from classification and grading tags from other unrelated industries, effectively avoiding the risk of incorrect matching due to inconsistencies in cross-industry standards, but also significantly narrows the scope of underlying retrieval and calculation, thereby significantly improving the speed, efficiency, and accuracy of tag similarity matching and the final recommendation results.

[0109] In one possible implementation, if the tags in the shared tag knowledge base also include permission information, then encrypted data matching the query vector can be searched in at least one shared tag knowledge base according to the vector search algorithm and the permission information to obtain at least one candidate tag. The permission information in each candidate tag is used to indicate whether the target tenant is allowed to access the candidate tag.

[0110] This can also be understood as the system employing a dual filtering mechanism—combining semantic matching calculation and access permission verification—when selecting candidate tags from the shared knowledge base. In a multi-tenant architecture, each tag representing shared sensitive data carries its own permission information (e.g., access control whitelist, IAM identity, or RBAC role) to clearly define which other tenants have the right to access and reuse the tag. Therefore, when a target tenant initiates a search, the system not only uses an encrypted vector search algorithm to match the most semantically similar encrypted tags but also simultaneously verifies whether the target tenant is included within the permitted access permissions of these candidate tags. This mechanism helps ensure that each candidate tag ultimately recommended to the target tenant is both highly matched in terms of data characteristics and has received explicit authorization from the sharing party in terms of security and compliance, thereby effectively preventing unauthorized use of the tag knowledge assets of sensitive data.

[0111] For example, in one possible implementation, the first request message also includes a fifth indication message, which indicates "enabling heuristic correction function". For instance, when a target tenant creates a sensitive data identification task, they can choose whether to enable the "heuristic correction algorithm" function through a specific configuration switch (i.e., the fifth indication message), giving the user control over whether to participate in label optimization. For example, in another possible implementation, the solution in this application uses the heuristic correction function by default; this can also be understood as meaning that the heuristic correction function will be executed regardless of whether the first request message carries the fifth indication message.

[0112] In this application, "heuristic correction" can be understood as an intelligent optimization mechanism. When this function is triggered, the system will complete a preliminary scan in the target data source, obtain preliminary labels for each target sensitive data, and then asynchronously search for semantically highly matching labels in the shared label knowledge base to obtain at least one candidate label. For example, subsequent matching degree judgment can be performed by calculating cosine similarity, combining historical successful experience and industry standards, etc., thereby automatically replacing erroneous labels in the preliminary labels or recommending more accurate semi-automatic correction suggestions to tenants. Its core purpose is to use shared knowledge across tenants to reduce system false alarms and significantly reduce the workload of manual review of hierarchical classification labels. The heuristic correction function will be described in detail below through step 150.

[0113] 150. Based on at least one candidate label, determine the hierarchical information and / or classification information of the target sensitive data.

[0114] In this application, at least one candidate label obtained from a shared label knowledge base can be used to obtain hierarchical and / or classification information in the labels of each target sensitive data.

[0115] In this application, the data management system also includes a local tag knowledge base for the target tenant, which includes tags for at least one sensitive data of the target tenant. For example, the tags for the sensitive data of the target tenant include the following information: encrypted data, hierarchical information, classification information, rule information, and permission information. In this case, the hierarchical information and / or classification information of the target sensitive data can be determined based on at least one candidate tag, the target tenant's local tag knowledge base, and rule information. A detailed explanation is provided below for each scenario.

[0116] Scenario 1: The initial label does not include rule information. In one possible implementation, if the initial label of the target sensitive data does not include the rule information, the rule information of the target sensitive data is determined based on the rule information of at least one candidate label, wherein the rule information of the target sensitive data is the same as the rule information in a candidate label; according to a matching algorithm, the rule information that matches the rule information of the target sensitive data is searched in the target tenant's local label knowledge base to obtain the target label, wherein the matching degree between the rule information in the target label and the rule information of the target sensitive data is greater than or equal to a first threshold; the hierarchical information and / or classification information of the target sensitive data are determined based on the hierarchical information and / or classification information of the target label.

[0117] For example, after the scanning module completes the initial identification of the target sensitive data, the system checks its generated initial tags. If it finds that the initial tags are missing rule information (e.g., failing to match a specific rule name R and its corresponding rule segmentation vector Rv), the system will enter the processing logic of scenario 1. At this time, the system will extract the rule information carried by at least one candidate tag previously recalled from the shared tag knowledge base (e.g., the candidate tag with the highest matching score), and directly assign this rule information to the current target sensitive data, giving the target sensitive data basic rule attributes. Then, secondary vector matching can be performed in the tenant's local tag knowledge base. For example, after the target sensitive data obtains new rule information (i.e., rule segmentation vector Rv), the system does not directly use the final tag from the shared tag knowledge base, but switches the search domain back to the target tenant's exclusive local tag knowledge base. The system will use a matching algorithm to retrieve the existing rule in the local tag knowledge base that is closest to this newly assigned rule information. For example, "matching degree greater than or equal to the first threshold" can be understood as calculating the cosine distance between two rule segmentation vectors. The smaller the cosine distance, the closer the semantics of the two rules are in the multidimensional vector space, and the higher the matching degree. Next, the final confirmation of local hierarchical and classification information is completed: after the system successfully locates the target label with the smallest distance and the best semantic match in the tenant's local label knowledge base using the above algorithm, it will extract the hierarchical and classification information bound to this target label. Finally, the system will formally assign this set of high-confidence hierarchical and classification information from the tenant's local data to the target sensitive data, thereby completing the label determination of the data.

[0118] For example, suppose target tenant #1 is a core financial research and development institution with high confidentiality requirements. The system is currently scanning the institution's internal human resources system data. The target sensitive data is a "Core R&D Employee Departure and Non-Competition Compensation Agreement", which contains a key piece of information: "The bank account for receiving compensation from departing employee Zhang is: 622202...".

[0119] Afterwards, the system encrypted the context information to obtain encrypted data, and successfully matched a highly similar candidate tag shared by an emerging internet fintech startup (tenant #2) in the shared tag knowledge base through encrypted search. The core information of the candidate tag is as follows: (1) Rule information (R): bank account number; (2) Classification information (F): ordinary financial data; (3) Grading information (L): L2 (medium sensitivity); (4) Encrypted data: XXXX; (5) Permission information: allow tenant #1 to access the tag. Afterwards, the system did not directly apply the "L2" grading and "ordinary financial data" classification of the tag in tenant #2. Instead, it extracted the rule information (i.e. "bank account number") in the candidate tag and switched the search domain back to the local tag knowledge base of the financial institution (tenant #1) to find the existing local standard that matches "bank account number". For example, through the search in the local tag knowledge base, the determined classification information is: core employee privacy and confidential salary data (instead of "ordinary financial data" in the candidate tag database), and the grading information is: L4 (instead of "L2" in the candidate tag).

[0120] Based on the above technical solution, in this application, when the initial scan fails to fully identify the rule information, the system can first use high-scoring candidate tags from the shared tag knowledge base to complete the missing rule attributes, and then switch back to the target tenant's local tag knowledge base for secondary precise matching. This implementation method not only eliminates the identification blind spot caused by the omission of initial rules, but also ensures that the final assigned hierarchical classification tags can give priority to the tenant's historical successful experience, making the tag assignment process more reasonable. Thus, while improving the success rate of automated correction, it ensures that the tag optimization results not only comply with industry standards, but also perfectly meet the actual personalized business needs of specific tenants.

[0121] Scenario 2: Scenario where the initial label includes rule information In another possible scenario, the initial label for the target sensitive data is determined, including rule information; a first matching degree between each candidate label and the initial label is determined according to a matching algorithm; and the hierarchical information and / or classification information of the target sensitive data is determined based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information.

[0122] In this application, when the system initially scans and finds that the initial label of the target sensitive data already contains clear rule information (e.g., the initial label contains the rule name and its corresponding rule segmentation vector Rv), the system will use a matching algorithm (such as calculating the weighted cosine distance of the encrypted vector) to quantitatively evaluate the comprehensive semantic similarity (i.e., the first matching degree) between each candidate label recalled by the shared knowledge base and the initial label. Subsequently, based on this calculated matching degree score and combined with the determined rule information, the system will switch the search domain back to the target tenant's local label knowledge base for secondary matching, thereby finding the tenant's historical experience that best matches the current rule semantics. Finally, this will be used to accurately extract and determine the final hierarchical and classification information of the target sensitive data, and complete the label assignment process.

[0123] Based on this implementation, when the initial tags already contain rule information, the system calculates the first matching degree with candidate tags in the shared knowledge base to introduce prior experience for similarity verification. Then, it combines this matching degree with the target tenant's local tag knowledge base for final confirmation. This approach combines globally shared knowledge with local historical success experience, effectively resolving conflicts arising from inconsistencies in standards across tenants or industries, prioritizing the accuracy of specific business specifications for the tenant, and significantly reducing the workload of manual tagging and review. Ultimately, it ensures that the automatically assigned hierarchical classification tags possess both high reliability and consistency, while also guaranteeing the personalized data security and compliance needs of specific tenants.

[0124] For example, the first matching degree between each candidate tag and the initial tag is obtained based on the matching degree between the candidate tag and the various pieces of information included in the initial tag. In one possible implementation, the first matching degree between each candidate tag and the initial tag is obtained based on a second matching degree between the candidate tag and the initial tag, and a third matching degree between the candidate tag and the initial tag, wherein the second matching degree is the matching degree between the context information of the sensitive data of the candidate tag and the query vector, and the third matching degree is the matching degree between the rule information of the candidate tag and the rule information of the initial tag.

[0125] Based on this implementation, the final comprehensive evaluation score (i.e., the first matching degree) is derived by comprehensively considering the matching degree of the contextual information of sensitive data (i.e., the second matching degree) and the matching degree of specific rule information (i.e., the third matching degree). This avoids the error risks that are easily caused by single-dimensional comparison (e.g., the same rule is hit but the business context is very different, or the contextual context is similar but the specific rule type is different). That is, it ensures that the prior candidate tags selected from the shared knowledge base are not only highly consistent in specific sensitive entity patterns, but also completely consistent in the contextual semantic environment of actual application, thereby significantly improving the accuracy of candidate tag selection and further reducing the false alarm rate and the workload of manual review in the multi-tenant automated hierarchical classification process.

[0126] Specifically, scenario 2 can be further divided into the following three situations, which will be introduced below.

[0127] Case 1 In one possible scenario, candidate tags are determined based on a first matching degree and a second threshold between each candidate tag and the initial tag, wherein the first matching degree between the candidate tags and the initial tag is greater than or equal to the second threshold; rule information of the target sensitive data is obtained based on the rule information of the candidate tags, wherein the rule information of the target sensitive data is the same as the rule information of a candidate tag; rule information similar to the rule information of the target sensitive data is searched in the target tenant's local tag knowledge base to obtain the target tag, wherein the matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to the first threshold; and the hierarchical information and / or classification information of the target sensitive data are determined based on the hierarchical information and / or classification information of the target tag.

[0128] For example, in Case 1, the system first calculates the first matching degree between each candidate tag recalled from the shared tag knowledge base and the initial tag of the target sensitive data, and performs preliminary filtering using a preset second threshold, retaining only those candidate tags whose similarity meets the standard (greater than or equal to the second threshold). Then, the system extracts the rule information of the high-scoring candidate tag and confirms it as the current rule attribute of the target sensitive data. Next, the system switches the search domain to the target tenant's local tag knowledge base and uses a matching algorithm (such as calculating vector distance, where a distance value greater than or equal to the first threshold represents a high semantic match) to find the existing target tag that best matches the rule information locally. Finally, the system directly extracts the hierarchical and classification information bound to the local target tag and formally assigns it to the target sensitive data, completing the final determination of the target sensitive data tag information. Case 1 can be understood as a fully automated tag correction process within a heuristic tag correction workflow.

[0129] In this application, the system first uses high-similarity candidate tags from a shared knowledge base to determine rule information, and then switches back to the target tenant's local tag knowledge base to extract the final hierarchical and classification information. This prioritizes the use of the tenant's past successful experience, making the tag assignment process more reasonable and ensuring that the final optimized tag results perfectly match the actual business needs and security compliance of the specific tenant. This significantly reduces the workload of manual review and tag determination, achieving both improved accuracy and personalized matching.

[0130] Case 2 In another possible scenario, a first matching degree between each candidate label and the initial label is determined to be less than or equal to a second threshold and greater than or equal to a third threshold; suggestion information is sent, indicating recommended hierarchical and / or classification information for the target sensitive data; feedback information is received, indicating manually confirmed hierarchical and / or classification information for the target sensitive data. Based on the feedback information, the hierarchical and / or classification information for the target sensitive data is determined.

[0131] Scenario 2 can be understood as a "semi-automatic correction mode" in the heuristic label correction process. When the system calculates that the similarity between the candidate label and the initial label is in the middle range (i.e., below the second threshold but above the third threshold representing the secondary threshold), it means that the confidence of automatic correction is insufficient for direct automatic replacement. In this case, the system can first determine the suggested information. For example, based on at least one candidate label recalled from the shared label knowledge base through encrypted vector search, the system will comprehensively consider the cosine similarity scores of these labels and incorporate multiple heuristic rules (e.g., prioritizing labels with the same industry attributes, evaluating the frequency of label usage among multiple tenants, and indicators such as the accuracy of historical corrections) to make intelligent decisions, thereby extracting the most valuable hierarchical and classification information as "suggested information". Subsequently, the system will send the suggested information to the tenant's visual operation interface for manual intervention (i.e., manual confirmation of adoption of the suggested information or manual re-determination of hierarchical and classification information). After receiving explicit feedback from the user, the system will finally complete the accurate assignment and optimization of the target sensitive data labels, thereby reducing false alarms while ensuring the processing quality of key scenarios.

[0132] For example, when determining recommendation information, the system can proactively extract the industry attributes of the scanning template set by the tenant when configuring the scanning task. Based on this attribute, it prioritizes selecting industry-level classification tag libraries under the same or similar standards and directly excludes tags from irrelevant industries. For example, if a tag is frequently used by multiple tenants, it often means that the tag's definition represents a very high level of industry consensus and universality. Therefore, when determining recommendation information, the system will evaluate the usage frequency of these candidate tags and prioritize extracting high-quality tags with a broad acceptance base as recommendations. For example, the system can maintain a historical successful correction dataset, and all correctly corrected tags will be fed back into this dataset for continuous optimization of the heuristic correction algorithm. Therefore, when generating the final recommendation, the system will retrieve and comprehensively consider the historical successful correction experience of candidate tags. If a tag is frequently manually confirmed and adopted in historical recommendations (i.e., high historical accuracy), its weight in the decision-making process will be increased accordingly.

[0133] In this application, when the system determines that the confidence level of automated correction is insufficient for direct replacement, a semi-automatic suggestion is triggered by setting a specific similarity range and then submitted for manual confirmation. This mechanism effectively avoids the matching error risk that fully automated systems may introduce in such uncertain scenarios. This approach fully utilizes a cross-tenant shared knowledge base (such as combining industry attributes, historical accuracy, and other heuristic rules) to provide users with high-quality correction references while securely retaining the final decision-making power to the tenants, thereby strongly ensuring the accuracy of label processing in critical and sensitive data scenarios.

[0134] Case 3 In another possible scenario, the first matching degree between each candidate label and the initial label is determined to be less than or equal to the third threshold; the hierarchical information and / or classification information of the target sensitive data are determined based on the hierarchical information and / or classification information of the initial label of the target sensitive data.

[0135] Case 3 can be understood as follows: when the system calculates that the similarity between all candidate tags recalled from the shared knowledge base and the initial tag is less than or equal to the third threshold representing the lowest reference value, it means that there is a lack of sufficient relevant prior experience in the shared tag knowledge base. In this case, the system will abandon the use of the system suggestion and directly adopt the initial hierarchical information and / or classification information generated by the target sensitive data in the preliminary scanning stage as the final result.

[0136] In this application, when the tags recommended in the shared tag knowledge base are extremely mismatched with the current business context, the system can decisively intercept and discard misleading suggestions with low relevance, and directly retain the results of the tags initially identified locally. This not only effectively avoids the risk of serious matching errors caused by forcibly applying irrelevant shared tags, but also ensures the accuracy of the automated hierarchical classification system for sensitive data.

[0137] As can be seen, in this application, the correction process comprehensively considers the semantic similarity between rule information (such as cosine distance), historical successful correction experience, and industry standard consistency. By updating labels automatically or semi-automatically (with manual confirmation), the workload of manual labeling is significantly reduced, and the consistency of label assignment is improved.

[0138] Furthermore, the method 100 provided in this application also includes: storing the hierarchical information and / or classification information of the target sensitive data into the target tenant's local tag knowledge base.

[0139] In this application, the hierarchical information (indicating the sensitivity level of the data, such as L1, L2, etc.) and / or classification information (indicating the data type, such as name, ID number, etc.) of the target sensitive data are ultimately stored in the target tenant's local tag knowledge base. For example, after the system finalizes the accurate hierarchical and classification tags of the target sensitive data through the aforementioned mechanisms such as automatic matching and replacement, semi-automatic suggestion for manual confirmation, or retaining the initial results due to low matching scores, it will persistently save this set of final confirmed identification results to the target tenant's dedicated local tag database. To ensure absolute data security, the database adopts a strict tenant isolation design at the underlying level, ensuring complete logical isolation of data between different tenants and preventing privacy leaks during the knowledge accumulation process. For example, while storing the final tag information, the system also synchronously updates the usage statistics of the tag knowledge base and records the decision path and effect indicators of this correction process in detail. This accumulated operational data will directly provide crucial data support for the continuous optimization of the underlying algorithm. Furthermore, for correction suggestions that have been manually confirmed by operators on the visual interface, the system will specifically feed these highly confident results back to the historical successful correction dataset of the correction module. Then, the successfully corrected tags are stored in the tenant's local tag knowledge base.

[0140] Based on the above technical solution, in this application, by saving the verified high-quality labels back to the local machine, the tenant not only establishes a private experience library that conforms to its own business specifications, but the system can also use these continuously accumulated historical successful correction data to continuously optimize the heuristic correction algorithm, thereby executing the label correction process more efficiently in the future.

[0141] Combining steps 110-150 above, Figure 2 This is another schematic diagram illustrating a method for identifying sensitive data as shown in an embodiment of this application, such as... Figure 2As shown, after the process starts, the system first checks whether the target tenant has enabled the tag sharing function: if not, it searches in the target tenant's local tag knowledge base and then ends the process. If enabled, the system scans the target data source to obtain the initial tags of the sensitive data and begins to traverse them one by one. During the traversal, for each initial tag, the system uses a vector search method to match at least one candidate tag. Subsequently, the system checks whether the initial tag has its own rule information: if there is no rule information, it directly generates the corresponding rule information based on the candidate tag and searches in the local tag knowledge base; if it has rule information, the system further calculates the first matching degree between the candidate tag and the initial tag, and performs traffic splitting based on whether the matching degree reaches a set threshold. When the matching degree reaches the threshold, Case 1 can be executed, where the system obtains the rule information based on the candidate tag and searches in the local tag knowledge base; when the matching degree does not reach the threshold, Case 2 and Case 3 are executed. In Case 2, suggestion information is sent and user feedback is received; in Case 3, the initial tag can be directly retained. For details, refer to the various scenarios and cases in step 150 above for understanding, which will not be elaborated further.

[0142] Figure 3 This is a schematic flowchart illustrating a method 300 for identifying sensitive data according to an embodiment of this application, such as... Figure 3 As shown, the target tenant first creates an identification task through the configuration interface module, which then responds and initiates the sensitive data scanning module. Upon entering the core processing stage, the scanning module performs a scan in the target data source to obtain initial tags for the sensitive data, and uses these tags to initiate a search request for encrypted data to the shared tag knowledge base. Subsequently, the shared tag knowledge base returns at least one candidate tag to the scanning module, which then passes these candidate tags to the correction module. Finally, the correction module uses its built-in correction algorithm to correct the tags and directly returns the corrected, accurate tags to the target tenant. The specific process can be understood by referring to the relevant flow of method 100 above, and will not be elaborated further.

[0143] Figure 4 This is another schematic flowchart illustrating a method for identifying sensitive data as shown in an embodiment of this application, such as... Figure 4As shown, tags in the shared tag knowledge base can be obtained through various channels. For example, pre-set industry-specific hierarchical and classification tags can be directly injected into the shared tag knowledge base through encrypted storage. Another example is that tenant #A can manually update tags for sensitive data through the tag maintenance interface. Yet another example is that tenant #N can automatically update tags and import them into the shared tag knowledge base by scanning sensitive data. Furthermore, the system has a strict compliance mechanism regarding privacy and access control. For instance, if tenant #B chooses not to enable tag sharing, their tag data will be completely closed and will never be used by other tenants. In the downstream application of tags, when tenant #C enables tag sharing, their corresponding correction module will initiate an encrypted search in the shared tag knowledge base. The shared tag knowledge base will retrieve and return at least one candidate tag. After processing by the correction module's heuristic correction algorithm, the tag is finally passed to the terminal interface for manual confirmation, thus achieving secure and controllable tag sharing and tag correction.

[0144] Furthermore, the method 100 provided in this application further includes: receiving a second request message from a target tenant, the second request message including fourth indication information, the fourth indication information being used to indicate a target data source; identifying sensitive data in the target data source according to the second request message, and obtaining an initial label for the target sensitive data, the initial label including contextual information of the target sensitive data; searching for labels similar to the initial label of the target sensitive data in the target tenant's local label knowledge base according to a similarity algorithm, obtaining similar labels, the similarity between the similar labels and the initial labels being greater than or equal to a fourth threshold; and obtaining hierarchical information and / or classification information of the target sensitive data based on the similar labels.

[0145] For example, in this implementation, the similarity between all the information in the initial tag and the corresponding information of each tag in the local tag knowledge base can be calculated to obtain similar tags; or, for another example, the similarity between the context information in the initial tag and the encrypted data of each tag in the local tag knowledge base can be calculated to obtain similar tags.

[0146] In this application, once a local tag knowledge base is established, when the system receives a specific identification request (i.e., the second request message) initiated by the target tenant, it will parse the special configuration parameters carried in the request (i.e., the fourth indication information). The system uses this indication information to accurately pinpoint the target data source (e.g., a specified object storage service OBS, relational database RDS, or file system) that needs to be connected to and scanned for this task. After connecting to the target data source, the system's underlying scanning module will scan the data using preset identification rules and generate initial tags for the target sensitive data. These initial tags not only record the hit data entities but also extract and include the contextual information of the target sensitive data (e.g., the textual context before and after containing the sensitive word), providing a rich data foundation for subsequent high-precision semantic matching. Next, after obtaining the initial tags with context, the system does not request a shared tag knowledge base but directly searches for tags in the target tenant's proprietary, logically isolated local tag knowledge base. For example, the system uses similarity algorithms (such as converting contextual information into word segmentation vectors and calculating cosine distance) to search for the prior tag in the locally accumulated historical tag pool that is semantically closest to the current initial tag. When the system calculates and finds that a similar tag in the local tag knowledge base has a very high similarity to the current initial tag, reaching or exceeding the confidence threshold set by the system (e.g., the fourth threshold), the system determines that the two are highly consistent in terms of business attributes. Subsequently, the system will directly extract the hierarchical and classification information of the local similar tag and use it as the final result to assign to the hierarchical and / or classification information of the current target sensitive data.

[0147] Based on the above technical solution, in this application, by using the target tenant's exclusive local tag knowledge base for high-threshold similarity matching, the system can maximize the use of the tenant's historically accumulated successful experience and improve the efficiency of automatic identification of sensitive data.

[0148] In this application, a heuristic correction algorithm is provided, which empowers tenants to choose the sharing function. This respects the different data privacy requirements of different customers and provides an optimization path for customers who are willing to participate in sharing, thereby enhancing the flexibility and acceptability of the solution.

[0149] For example, in this application, the thresholds (e.g., the first to fourth thresholds) are not fixed, but can be adaptively adjusted based on the historical correction accuracy of a specific tenant. This dynamic mechanism has high intelligent value in practical applications, mainly reflected in the system's ability to automatically find the optimal balance between processing efficiency and recognition accuracy based on the tenant's actual usage feedback. For example: ① High historical accuracy, adaptive bias towards efficiency: If a tenant has frequently adopted or confirmed the hierarchical classification tags recommended or automatically replaced by the system in past operations, it indicates that the shared tag knowledge is highly compatible with the tenant's business context. In this case, the system will automatically lower the threshold appropriately, allowing more high-quality tags with a certain degree of similarity to directly trigger automatic correction or semi-automatic recommendation, thereby minimizing the workload of manual review and improving the overall automation efficiency of scanning and labeling. ② Low historical accuracy, adaptive bias towards accuracy: If the tenant frequently needs to manually overturn or modify the system-recommended tags, it indicates that there is a significant difference between the shared tag knowledge base and the tenant's personalized or stringent standards. In this case, the system will automatically raise the threshold, making the matching conditions more stringent. This means that only tags with extremely high semantic similarity and confidence will be adopted in the future, thereby establishing a stronger security defense line, effectively reducing the false alarm rate, and preventing incorrect tags from polluting the local database.

[0150] The following example illustrates the method provided in this application using a specific scenario.

[0151] For example, in a scenario where a service provider offers data security classification and grading services to multiple enterprise tenants, tenant #C, as a financial institution, needs to regularly identify and classify sensitive data from its large volume of stored customer transaction data. Due to the special nature of the financial industry, tenant #C has high requirements for the accuracy and efficiency of data identification. In traditional solutions, tenant #C needs to manually review and correct a large number of automatically identified (prone to false positives) labels, which is labor-intensive and difficult to reuse later. In this embodiment, tenant #C, through a heuristic correction algorithm, can leverage the label knowledge base accumulated by other existing tenants (such as tenant #A, tenant #B, and tenant #N) to optimize its own manual review process for sensitive data identification results, significantly reducing the false positive rate and review workload of the classification labels, while ensuring data privacy and security. In addition, tenant #C can share the completed scanning and identification of classification labels with other departments for subsequent scanning tasks by "enabling the label sharing function".

[0152] Step 1: Tenant #C enables tag sharing and heuristic correction in the configuration interface.

[0153] Tenant #C accesses the identification task creation interface by logging into the service provider's data security center system. During task configuration, Tenant #C needs to explicitly check the "Enable Tag Sharing" and "Enable Heuristic Correction Algorithm" checkboxes on the "Scan Task Configuration Page." From a physical implementation perspective, this configuration interface runs on the service provider's application server, providing a graphical interface to Tenant #C via a web service. After Tenant #C clicks the confirmation button, the configuration information is encapsulated into a JSON request message and transmitted to the backend task management module via HTTPS.

[0154] Upon receiving a configuration request, the task management module first verifies the permissions and the validity of the configuration parameters for tenant #C. If verification is successful, the system creates a corresponding task configuration record for tenant #C in the metadata configuration repository and enables the "heuristic correction flag." These flags will serve as the basis for decision-making in subsequent scanning and correction processes. Simultaneously, the system generates a unique task ID for tracking and associating various processing stages throughout the task lifecycle. The key technical aspect of this step lies in the secure transmission and persistent storage of configuration information, ensuring that the tenant's configuration intent is accurately conveyed to subsequent processing modules.

[0155] Step 2: The system performs a sensitive data scan and generates preliminary identification results.

[0156] After receiving the task execution instruction, the scanning module first connects to the data source specified by tenant #C according to the task configuration information. The data source may be an object storage service, a database instance, or a file system, etc. The scanning module scans the target data according to a preset scanning strategy. Each data shard goes through a sensitive data identification pipeline, which includes three main stages: pattern matching based on regular expressions, semantic analysis based on machine learning models, and logical judgment based on predefined rules.

[0157] In the pattern matching stage, the scanning module loads tenant #C's custom recognition rules and the system's pre-defined general rules (with industry attributes) to quickly match the data content. For successfully matched data items, the system generates preliminary recognition results including location information, matching rule ID, and confidence score. In the semantic analysis stage, the system uses pre-trained models such as BERT to vectorize the data content and then uses a neural network classifier to determine whether the data belongs to a sensitive data type. Finally, in the logical judgment stage, the system combines the results of the first two stages and applies algorithms such as decision trees to generate the final preliminary recognition label. The preliminary results of this hierarchical classification and recognition step are temporarily and securely stored in the database, awaiting subsequent asynchronous correction processing.

[0158] Step 3: Obtain similar tags from the knowledge base using encrypted vector search technology.

[0159] After obtaining the initial identification results, the correction module will check the tag sharing flag of tenant #C (performing relevant permission verification; the permission verification logic is not necessarily based on a whitelist, but can also be based on IAM permissions, etc.). If the flag is enabled, the correction module will initiate the encrypted vector search process.

[0160] First, the correction module uses vector encryption to encrypt the feature vectors of the data to be queried, ensuring that tenant #C's original data does not leave its security boundary in plaintext. The encrypted vector query request is then sent to the search interface of the sensitive data tag knowledge base for a searchable encrypted query. The query conditions include the industry attributes of the scanned template from step 2, thus shielding the influence of irrelevant industry classification tags. The sensitive data tag knowledge base maintains tag vector indexes from multiple tenants, which are also stored in encrypted form. Upon receiving the query request, the knowledge base's search module executes an approximate nearest neighbor search algorithm within the encrypted domain to find the top 3 classification tag candidate sets most similar to the query vector. The entire search process is implemented using searchable encryption, ensuring that the knowledge base or third parties cannot know the specific query content, and tenant #C cannot directly access other tenants' original tag data. After the search is complete, the knowledge base returns tag information, which will be used to support subsequent correction decisions.

[0161] Step 4: The correction module calculates similarity and performs label optimization.

[0162] After receiving the top 3 similar tags, the correction module will initiate a multi-stage heuristic tag decision process. For details, please refer to the content in Method 150 above.

[0163] Step 5: Update the correction results and provide feedback to tenant #C.

[0164] After correction, the system will persist the final recognition results to tenant #C's dedicated tag database. The database adopts a tenant-isolated design to ensure complete data isolation between different tenants. Simultaneously, the system will update the usage statistics of the tag knowledge base, record the decision path and performance metrics of this correction, and provide data support for subsequent algorithm optimization. For correction suggestions requiring manual confirmation, operators can compare the differences between the labels before and after correction on a dedicated visual interface, refer to the similarity analysis and decision criteria provided by the system, and make a final confirmation. All manual confirmation results are fed back into the historical successful correction dataset of the correction module for continuous optimization of the heuristic correction algorithm and acceleration of subsequent correction processes.

[0165] In one possible deployment, the user interface module is typically deployed on a web server for users to access via a browser. The sensitive data scanning module, correction module, and shared tag knowledge base are deployed as backend services within the cloud platform's data center. For example, they might run as microservices in containers, communicating over an internal network. All tenants share the same backend service infrastructure, but data security and privacy are ensured through strict tenant logical isolation mechanisms.

[0166] The technical solution provided in this application enables the secure sharing and utilization of data classification and grading label knowledge among multiple isolated tenants. This feature allows for flexible application to various cloud deployment models. For example: ① Public cloud application: This is the most direct application scenario for this solution. Public cloud platforms have a massive number of tenants, generating an extremely rich knowledge base of classification and grading labels. This solution can maximize its value, helping new tenants or tenants with low label quality requirements to quickly improve their baseline level of data identification and classification. In terms of deployment, the sensitive data label knowledge base can be provided as a platform-level service, uniformly maintained and managed by the cloud service provider, providing shared services to all tenants. ② Hybrid cloud and private cloud application: In hybrid cloud or private cloud environments, the deployment form and value proposition of the solution may evolve. For example, in the private cloud of a large enterprise group, different departments or subsidiaries can be regarded as "internal tenants". This solution can be used to share and unify data classification and grading standards within the group, promoting cross-departmental data governance compliance. In this case, the deployment of the knowledge base may be more inclined to be distributed or federated, that is, under the premise of ensuring that the data of each branch does not leave the domain, only encrypted label vector features are exchanged to achieve limited knowledge sharing. This variation requires the solution to support more complex trust models and policy synchronization mechanisms.

[0167] The technical solution provided in this application can be applied to a variety of scenarios, and examples are given below.

[0168] For example, the technical solution provided in this application can be applied to data compliance auditing in the financial industry: Banks, insurance companies, and other financial institutions need to regularly identify and classify sensitive data from stored customer information to meet compliance requirements such as the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCIDSS). This solution can help them leverage best practices in industry-wide classification and labeling to quickly improve identification accuracy and reduce data security audit preparation time and labor costs.

[0169] For example, the technical solution provided in this application can be applied to healthcare data security management: hospitals or medical research institutions store a large number of electronic health records, which contain highly sensitive personal information. By applying this solution, medical institutions can share experience in the classification and grading of specific medical terms or diagnostic results, and optimize data anonymization and access control strategies, while strictly protecting patient privacy.

[0170] For example, the technical solution provided in this application can be applied to cross-departmental data opening and sharing: before opening data to the public or research institutions, departments need to identify and filter sensitive information. Different departments may have different classifications for similar types of data. This solution can promote the secure sharing of labeling knowledge between departments, improve the efficiency and consistency of data opening, and reduce the risk of sensitive information leakage.

[0171] For example, the technical solution provided in this application can be applied to data governance of large enterprises with multiple branches: In a unified data governance platform, each branch can act as a "tenant" for a large enterprise with multiple subsidiaries or business units. This solution can promote the standardization of data classification and grading among branches, and improve the overall data security protection level and management efficiency of the enterprise.

[0172] Furthermore, the technical solution provided in this application can also be applied to the following areas: ① Network security threat detection: In the field of security operations centers or network threat detection, different enterprises (which can also be understood as tenants) often encounter similar security threats or attack patterns. This solution can be used as a reference to design a knowledge base that shares security threat indicators (such as malicious Internet Protocol addresses, abnormal behavior patterns, etc.). When a local detection system of each enterprise discovers a suspicious event, it can encrypt and query the central knowledge base or peer knowledge base to obtain information verified by other enterprises to optimize its own detection rules, improve the accuracy and timeliness of threat discovery, and avoid leaking sensitive details of its own network security events. ② AI-assisted diagnosis of medical images: Medical image data and expert annotations (which can be regarded as "tags") accumulated by different hospitals (which can also be understood as tenants) are key to training high-quality AI models, but are difficult to share directly due to patient privacy regulations. The approach of this solution can be applied, whereby each hospital encrypts and uploads the de-identified image feature vectors and diagnostic conclusions (classification tags) to a trusted consortium knowledge base. When the confidence level of a hospital's new image analysis results is low, the final diagnostic labels of similar cases in the knowledge base can be encrypted and retrieved to provide doctors with auxiliary references, thereby improving the overall level of medical diagnosis while protecting patient privacy.

[0173] The technical solutions provided in this application can also be applied to various cloud service products that provide data security services, especially those products that include data discovery, classification and grading, and sensitive information identification functions. For example: ① Data security centers or similar products: as an advanced function, enhancing their existing automatic identification and classification capabilities for sensitive data. ② One-stop data security governance platforms: as a core component of data asset catalogs and classification and grading modules, improving the level of automated labeling. ③ Data desensitization or data encryption services: providing more accurate and efficient criteria for locating sensitive data.

[0174] For example, the solution provided in this application can be applied in cloud scenarios (e.g., public cloud, private cloud) or in ordinary scenarios (e.g., single-machine deployment). Figure 5 This is another schematic diagram of a cloud service system architecture to which this application applies, such as Figure 5 As shown, the cloud service system architecture may include: a cloud management platform 510, an internet connection 520, and a client 530. For example... Figure 5 As shown, the cloud management platform 510 is used to manage the infrastructure that provides multiple cloud services. The infrastructure includes multiple cloud data centers, each containing at least one server, and each server containing cloud service resources to provide corresponding cloud services to tenants. For example, the cloud service resource could be a cloud database.

[0175] For example, the method provided in this application can be applied to a cloud service system, which includes a cloud management platform and infrastructure. The cloud management platform is used to manage the infrastructure that provides cloud services (e.g., services for identifying sensitive data). For example, the infrastructure includes at least one data center, which is equipped with at least one server. For example, the infrastructure can be used to perform methods 100 and 300 described above. For example, interaction with users can be achieved through the cloud management platform.

[0176] It is understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0177] It should also be understood that the ordinal numbers such as "first" and "second" mentioned in this application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority or importance of multiple objects.

[0178] It should also be understood that, in this application, "at least one" means one or more, and "more than one" means two or more. "At least one item" or similar expressions mean one or more items, that is, any combination of these items, including any combination of single items or multiple items. For example, at least one of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c.

[0179] It should also be understood that, in the various embodiments of this application, determining B based on A does not mean that B is determined solely based on A; B can also be determined based on A and / or other data.

[0180] It should be noted that the various implementation methods in this application can be reasonably combined according to their internal logic.

[0181] Those skilled in the art will recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0182] This application can divide a computing device into functional modules based on the above method example. For example, it can divide the device into separate functional modules corresponding to each function, or it can integrate two or more functions into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this application is illustrative and only represents one logical functional division; other division methods may be used in actual implementation. The following explanation uses the division of functional modules according to each function as an example.

[0183] Figure 6 This is a schematic block diagram of the device 600 for identifying sensitive data provided in this application. As shown in the figure, the device includes: a configuration interface module 610, a scanning module 620, and a correction module 630.

[0184] In this application, the device is applied to a data management system, which includes at least one shared tag knowledge base. The shared tag knowledge base includes tags for sensitive data belonging to multiple tenants. Each tenant's sensitive data tag includes encrypted data, hierarchical information, and classification information. The encrypted data is obtained by encrypting the feature vector of the context information of the tenant's sensitive data. The device includes: a configuration interface module, a scanning module, and a correction module. The configuration interface module is used to receive a first request message from a target tenant. The first request message indicates an identification task and includes first and second indication information. The first indication information indicates a target data source, and the second indication information indicates enabling the tag sharing function. The scanning module is used to identify sensitive data in the target data source according to the first request message and obtain an initial tag for the target sensitive data. The initial tag includes the context information of the target sensitive data. The scanning module is used to extract features from the context information of the target sensitive data in response to the second indication information and encrypt the extracted feature vector to obtain a query vector. The scanning module is used to search for encrypted data matching the query vector in at least one shared tag knowledge base according to a vector search algorithm to obtain at least one candidate tag. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate tag.

[0185] In one possible implementation, the first request message further includes third indication information, which is used to indicate the target industry attribute corresponding to the identification task. The scanning module is used to search for encrypted data matching the query vector in at least one shared tag knowledge base according to the vector search algorithm to obtain at least one candidate tag. The scanning module is used to search for encrypted data matching the query vector in at least one shared tag knowledge base according to the vector search algorithm and the third indication information to obtain at least one candidate tag, wherein the industry attribute to which each candidate tag belongs matches the target industry attribute.

[0186] In one possible implementation, the label of each tenant's sensitive data also includes permission information, which indicates which tenants are allowed to access the label. The scanning module is used to search for encrypted data matching the query vector in at least one shared label knowledge base according to the vector search algorithm to obtain at least one candidate label. The scanning module is used to search for encrypted data matching the query vector in at least one shared label knowledge base according to the vector search algorithm and permission information to obtain at least one candidate label. The permission information in each candidate label is used to indicate which target tenants are allowed to access the candidate label.

[0187] In one possible implementation, the data management system further includes a local tag knowledge base of the target tenant, which includes tags for at least one sensitive data of the target tenant. The tags for the sensitive data of the target tenant include the following information: encrypted data, hierarchical information, classification information, permission information, and rule information. The rule information is used to indicate the identification rules for the sensitive data. A correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on at least one candidate tag. This includes: a correction module used to determine the hierarchical information and / or classification information of the target sensitive data based on at least one candidate tag, the target tenant's local tag knowledge base, and the rule information.

[0188] In one possible implementation, a correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on at least one candidate label, the target tenant's local label knowledge base, and rule information. This includes: a correction module determining that the initial label of the target sensitive data does not include rule information; a correction module determining the rule information of the target sensitive data based on the rule information of at least one candidate label, wherein the rule information of the target sensitive data is the same as the rule information in a candidate label; and a correction module searching for rule information matching the rule information of the target sensitive data in the target tenant's local label knowledge base according to a matching algorithm to obtain a target label, wherein the matching degree between the rule information in the target label and the rule information of the target sensitive data is greater than or equal to a first threshold. The correction module is used to determine the hierarchical and / or classification information of the target sensitive data based on the hierarchical and / or classification information of the target label.

[0189] In one possible implementation, the correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on at least one candidate label, the target tenant's local label knowledge base, and rule information. This includes: a correction module for determining that the initial label of the target sensitive data includes rule information; a correction module for determining a first matching degree between each candidate label and the initial label based on a matching algorithm; and a correction module for determining the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information.

[0190] In one possible implementation, the first matching degree between each candidate tag and the initial tag is obtained based on the second matching degree between the candidate tag and the initial tag, and the third matching degree between the candidate tag and the initial tag. The second matching degree is the matching degree between the context information of the sensitive data of the candidate tag and the query vector, and the third matching degree is the matching degree between the rule information of the candidate tag and the rule information of the initial tag.

[0191] In one possible implementation, the correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on a first matching degree between each candidate tag and the initial tag, the target tenant's local tag knowledge base, and rule information. This includes: a correction module for determining filtered candidate tags based on a first matching degree and a second threshold, wherein the first matching degree between the filtered candidate tags and the initial tag is greater than or equal to the second threshold; a correction module for obtaining rule information of the target sensitive data based on the rule information of the filtered candidate tags, wherein the rule information of the target sensitive data is the same as the rule information of a filtered candidate tag; a correction module for searching for rule information similar to the rule information of the target sensitive data in the target tenant's local tag knowledge base to obtain a target tag, wherein the matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to the first threshold; and a correction module for determining the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the target tag.

[0192] In one possible implementation, the correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on a first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information. This includes: the correction module determining that the first matching degree between each candidate label and the initial label is less than or equal to a second threshold and greater than or equal to a third threshold; the correction module sending suggestion information indicating recommended hierarchical information and / or classification information for the target sensitive data; the correction module receiving feedback information indicating manually confirmed hierarchical information and / or classification information for the target sensitive data; and the correction module determining the hierarchical information and / or classification information of the target sensitive data based on the feedback information.

[0193] In one possible implementation, the correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and rule information. This includes: the correction module determining that the first matching degree between each candidate label and the initial label is less than or equal to a third threshold; and the correction module determining the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the initial label of the target sensitive data.

[0194] In one possible implementation, the device further includes a caching module for storing the hierarchical and / or classification information of the target sensitive data in the target tenant's local tag knowledge base.

[0195] In one possible implementation, the configuration interface module is further configured to receive a second request message from the target tenant, the second request message including fourth indication information, the fourth indication information being used to indicate the target data source; the scanning module is further configured to identify sensitive data in the target data source according to the second request message, and obtain an initial label for the target sensitive data, the initial label including contextual information of the target sensitive data; the scanning module is further configured to search for labels similar to the initial label of the target sensitive data in the target tenant's local label knowledge base according to a similarity algorithm, and obtain similar labels, the similarity between the similar labels and the initial labels being greater than or equal to a fourth threshold; the scanning module is further configured to obtain hierarchical information and / or classification information of the target sensitive data according to the similar labels.

[0196] It should be understood that the device 600 here is embodied in the form of a functional unit. The term "unit" here may refer to application-specific integrated circuits (ASICs), electronic circuits, processors (e.g., shared processors, proprietary processors, or group processors) and memories for executing one or more software or firmware programs, combined logic circuits, and / or other suitable components that support the described functions.

[0197] Each module in this device can be implemented in software or hardware. For example, the implementation of calibration module 630 will be described below. Similarly, the implementation of other modules can refer to the implementation of calibration module 630.

[0198] As an example of a software functional unit, the calibration module 630 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, the calibration module 630 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same Availability Zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0199] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same VPC or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0200] As an example of a hardware functional unit, the calibration module 630 may include at least one computing device, such as a server. Alternatively, the transceiver module may be implemented using a CPU, an ASIC, or a PLD. The aforementioned PLD may be implemented using a CPLD, FPGA, GAL, DPU, NPU, SoC, offload card, accelerator card, or any combination thereof.

[0201] The calibration module 630 includes multiple computing devices that can be distributed in the same region or in different regions. Similarly, the multiple computing devices in this module can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices in this module can be distributed in the same VPC or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, GALs, DPUs, NPUs, SoCs, offloading cards, and accelerator cards.

[0202] It should be noted that in other embodiments, the correction module 630 can be used to execute any step in method 100, and the other modules can also be used to execute any step in method 100. The steps that each module is responsible for implementing can be specified as needed. All functions of device 600 can be realized by implementing different steps in method 100 through each module.

[0203] For example, device 600 has the function of implementing the corresponding steps of method 100 described above. This function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions described above; for example, each module can be replaced by a processor, which respectively executes the transmit / receive operations and related processing operations in each method embodiment. Furthermore, each module can also be a processing circuit.

[0204] It should be pointed out that, Figure 6 The device mentioned can be a computing device, or a corresponding chip or chip system, such as a System-on-a-Chip (SoC). Each module refers to a processor, microprocessor, or integrated circuit integrated on that chip. No specific limitations are imposed here.

[0205] Figure 7This is a schematic block diagram of a computing device 700 provided in this application. As shown, the computing device 700 includes: a communication interface 710 and at least one processor 720. The processor 720 is coupled to a memory and is used to execute instructions stored in the memory to send and / or receive signals. Optionally, the computing device 700 also includes a memory 730 for storing instructions. The memory 730 and the processor 720 are connected via a bus 740. For example, the computing device 700 may be a server. It should be understood that this application does not limit the number of processors and memories in the computing device 700.

[0206] It should be understood that the processor 720 and memory 730 described above can be combined into a computing device, with the processor 720 executing the program code stored in the memory 730 to achieve the above functions. In specific implementations, the memory 730 can be integrated into the processor 720 or independent of the processor 720.

[0207] The 740 bus can be a Peripheral Component Interconnect Express (PCIe) bus, an Extended Industry Standard Architecture (EISA) bus, a Unified Bus (Ubus or UB), a Compute Express Link (CXL) bus, a Cache Coherent Interconnect for Accelerators (CCIX) bus, etc. The Unified Bus is also known as the Lingqu Bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus 740 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 740 may include a path for transmitting information between various components of the computing device 700 (e.g., memory 730, processor 720, communication interface 710).

[0208] The memory 730 stores executable program code, and the processor 720 executes the executable program code to implement the functions of the aforementioned modules, thereby implementing the method in this application. That is, the memory 730 stores instructions for executing the above-described method 100. For example, the processor 720 executes the computer program or instructions stored in the memory 730 to implement the various steps in the above-described method 100.

[0209] It should be understood that the computing device 700 according to the embodiments of this application may correspond to the device 600 for identifying sensitive data in this application, and may correspond to the corresponding subject in executing the method 100 according to the embodiments of this application. The above and other operations and / or functions of each module in the device are respectively for implementing the corresponding process of method 100. For the sake of brevity, they will not be described in detail here.

[0210] For example, computing device 700 may include means 600 for identifying sensitive data. As another example, computing device 700 may be means 600 for identifying sensitive data.

[0211] The communication interface 710 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 700 and other devices or communication networks.

[0212] This application also provides a chip system including a processor and a power supply circuit. The power supply circuit supplies power to the processor, which executes the operation steps corresponding to method 100. For simplicity, further details are omitted here. The processor can be implemented using a GPU, or it can be implemented using computing devices such as a DPU, NPU, XPU, SoC, offloading card, or accelerator card.

[0213] Figure 8 This is a schematic diagram of an architecture for a computing device cluster provided in this application. The computing device cluster includes at least one computing device. This computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone. Figure 8 As shown, the computing device cluster includes at least one computing device 800. The memory 830 of one or more computing devices 800 in the computing device cluster may store the same instructions for performing the actions executed in method 100 described above.

[0214] In some possible implementations, the memory 830 of one or more computing devices 800 in the computing device cluster may also store partial instructions for performing the actions executed in the method 100 described in the above embodiments. In other words, a combination of one or more computing devices 800 can jointly execute instructions for performing the actions executed in the method 100 described in the above embodiments.

[0215] It should be noted that the memory 830 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the computing device 800. That is, the instructions stored in the memory 830 of different computing devices 800 can implement the functions of one or more of the aforementioned modules.

[0216] Alternatively, the memories 830 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a corresponding part of the functions of the aforementioned device 900 and computing device 700. That is, the instructions stored in the memories 830 of different computing devices 800 can implement the functions of one or more of the aforementioned modules.

[0217] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 One possible implementation is shown, such as Figure 9 As shown, the two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each computing device. In this possible implementation, the memory 830 in computing device 800A stores instructions for executing the functions of the calibration module. Meanwhile, the memory 830 in computing device 800B stores instructions for executing the functions of the configuration interface module and the scanning module.

[0218] It should be understood that Figure 9 The functions of the computing device 800A shown can also be performed by multiple computing devices 800. Similarly, the functions of the computing device 800B can also be performed by multiple computing devices 800. For example, different computing devices can implement the functions of different modules. Figure 9 The connection method between the computing device clusters shown can be considered that, in some scenarios, the method provided in this application requires problem analysis and preliminary repair, so the functions implemented by the processing module are handed over to the computing device 800A for execution.

[0219] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, the at least one computing device performs method 100.

[0220] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform method 100.

[0221] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying sensitive data, characterized in that, The method is applied to a data management system, which includes at least one shared tag knowledge base. The shared tag knowledge base includes tags for sensitive data belonging to multiple tenants. Each tenant's sensitive data tag includes encrypted data, hierarchical information, and classification information. The encrypted data is obtained by encrypting the feature vector of the context information of the tenant's sensitive data. The method includes: Receive a first request message from the target tenant. The first request message is used to indicate an identification task. The first request message includes first indication information and second indication information. The first indication information is used to indicate the target data source. The second indication information is used to indicate that the tag sharing function is enabled. Based on the first request message, sensitive data in the target data source is identified, and an initial label for the target sensitive data is obtained, wherein the initial label includes the context information of the target sensitive data; In response to the second indication information, feature extraction is performed on the context information of the target sensitive data in the initial label, and the extracted feature vector is encrypted to obtain a query vector; According to the vector search algorithm, at least one candidate tag is obtained by searching for encrypted data that matches the query vector in the at least one shared tag knowledge base. Based on the at least one candidate label, determine the hierarchical information and / or classification information of the target sensitive data.

2. The method according to claim 1, characterized in that, The first request message also includes third indication information, which is used to indicate the target industry attribute corresponding to the identification task. The step of searching for encrypted data matching the query vector in the at least one shared tag knowledge base using a vector search algorithm to obtain at least one candidate tag includes: Based on the vector search algorithm and the third indication information, encrypted data matching the query vector is searched in the at least one shared tag knowledge base to obtain the at least one candidate tag, wherein the industry attribute of each candidate tag matches the target industry attribute.

3. The method according to claim 1 or 2, characterized in that, The sensitive data tags for each tenant also include permission information, which indicates which tenants are allowed to access the tags. The step of searching for encrypted data matching the query vector in the at least one shared tag knowledge base using a vector search algorithm to obtain at least one candidate tag includes: Based on the vector search algorithm and the permission information, encrypted data matching the query vector is searched in the at least one shared tag knowledge base to obtain at least one candidate tag. The permission information in each candidate tag is used to indicate whether the target tenant is allowed to access the candidate tag.

4. The method according to any one of claims 1 to 3, characterized in that, The data management system also includes a local tag knowledge base for the target tenant. This local tag knowledge base includes tags for at least one sensitive data item of the target tenant. The tags for the target tenant's sensitive data include the following information: the encrypted data, the hierarchical information, the classification information, and rule information. The rule information is used to indicate the identification rules for the sensitive data. The step of determining the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label includes: Based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information, determine the hierarchical information and / or classification information of the target sensitive data.

5. The method according to claim 4, characterized in that, The step of determining the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information includes: The initial label of the target sensitive data does not include the rule information; Based on the rule information of the at least one candidate label, the rule information of the target sensitive data is determined, wherein the rule information of the target sensitive data is the same as the rule information in a candidate label; According to the matching algorithm, the rule information that matches the rule information of the target sensitive data is searched in the local tag knowledge base of the target tenant to obtain the target tag. The matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to the first threshold. Based on the hierarchical information and / or classification information of the target label, determine the hierarchical information and / or classification information of the target sensitive data.

6. The method according to claim 4, characterized in that, The step of determining the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information includes: The initial label for the target sensitive data includes the rule information; According to the matching algorithm, the first matching degree between each candidate label and the initial label is determined; Based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information, the hierarchical information and / or classification information of the target sensitive data are determined.

7. The method according to claim 6, characterized in that, The first matching degree between each candidate tag and the initial tag is obtained based on the second matching degree between the candidate tag and the initial tag, and the third matching degree between the candidate tag and the initial tag, wherein the second matching degree is the matching degree between the context information of the sensitive data of the candidate tag and the query vector, and the third matching degree is the matching degree between the rule information of the candidate tag and the rule information of the initial tag.

8. The method according to claim 6 or 7, characterized in that, The step of determining the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate tag and the initial tag, the target tenant's local tag knowledge base, and the rule information includes: Based on a first matching degree and a second threshold between each candidate tag and the initial tag, a filtered candidate tag is determined, wherein the first matching degree between the filtered candidate tag and the initial tag is greater than or equal to the second threshold; Based on the rule information of the filtered candidate tags, the rule information of the target sensitive data is obtained, wherein the rule information of the target sensitive data is the same as the rule information of the filtered candidate tag; Search the local tag knowledge base of the target tenant for rule information similar to the rule information of the target sensitive data to obtain target tags. The matching degree between the rule information in the target tags and the rule information of the target sensitive data is greater than or equal to a first threshold. Based on the hierarchical information and / or classification information of the target label, determine the hierarchical information and / or classification information of the target sensitive data.

9. The method according to claim 6 or 7, characterized in that, The step of determining the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate tag and the initial tag, the target tenant's local tag knowledge base, and the rule information includes: Determine that the first matching degree between each candidate label and the initial label is less than or equal to a second threshold and greater than or equal to a third threshold; Send a suggestion message, which is used to indicate the hierarchical information and / or classification information recommended for the target sensitive data; Receive feedback information, which is used to indicate the hierarchical information and / or classification information of the target sensitive data that has been manually confirmed; Based on the feedback information, determine the hierarchical information and / or classification information of the target sensitive data.

10. The method according to claim 6 or 7, characterized in that, The step of determining the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate tag and the initial tag, the target tenant's local tag knowledge base, and the rule information includes: Determine that the first matching degree between each candidate label and the initial label is less than or equal to a third threshold; Based on the hierarchical information and / or classification information of the initial label of the target sensitive data, determine the hierarchical information and / or classification information of the target sensitive data.

11. The method according to any one of claims 1 to 10, characterized in that, The method further includes: The hierarchical information and / or classification information of the target sensitive data are stored in the target tenant's local tag knowledge base.

12. The method according to claim 11, characterized in that, The method further includes: Receive a second request message from the target tenant, the second request message including fourth indication information, the fourth indication information being used to indicate the target data source; Based on the second request message, sensitive data in the target data source is identified, and an initial label for the target sensitive data is obtained, wherein the initial label includes contextual information of the target sensitive data; According to the similarity algorithm, the target tenant's local tag knowledge base is searched for tags similar to the initial tags of the target sensitive data to obtain similar tags. The similarity between the similar tags and the initial tags is greater than or equal to the fourth threshold. Based on the similar labels, the hierarchical information and / or classification information of the target sensitive data are obtained.

13. A device for identifying sensitive data, characterized in that, The device is applied to a data management system, which includes at least one shared tag knowledge base. This shared tag knowledge base includes tags for sensitive data belonging to multiple tenants. Each tenant's sensitive data tag includes encrypted data, hierarchical information, and classification information. The encrypted data is obtained by encrypting the feature vector of the context information of the tenant's sensitive data. The device includes: a configuration interface module, a scanning module, and a correction module. The configuration interface module is used to receive a first request message from a target tenant. The first request message is used to indicate an identification task. The first request message includes first indication information and second indication information. The first indication information is used to indicate a target data source. The second indication information is used to indicate enabling the tag sharing function. The scanning module is configured to identify sensitive data in the target data source according to the first request message, and obtain an initial label for the target sensitive data, wherein the initial label includes context information of the target sensitive data; The scanning module is used to extract features from the context information of the target sensitive data in the initial label in response to the second indication information, and to encrypt the extracted feature vector to obtain a query vector. The scanning module is used to search for encrypted data that matches the query vector in the at least one shared tag knowledge base according to the vector search algorithm, so as to obtain at least one candidate tag; The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label.

14. The apparatus according to claim 13, characterized in that, The first request message also includes third indication information, which is used to indicate the target industry attribute corresponding to the identification task. The scanning module is used to search for encrypted data matching the query vector in the at least one shared tag knowledge base according to a vector search algorithm, to obtain at least one candidate tag, including: The scanning module is used to search for encrypted data matching the query vector in the at least one shared tag knowledge base according to the vector search algorithm and the third indication information, so as to obtain the at least one candidate tag, wherein the industry attribute to which each candidate tag belongs matches the target industry attribute.

15. The apparatus according to claim 13 or 14, characterized in that, The sensitive data tags for each tenant also include permission information, which indicates which tenants are allowed to access the tags. The scanning module is used to search for encrypted data matching the query vector in the at least one shared tag knowledge base according to a vector search algorithm, to obtain at least one candidate tag, including: The scanning module is used to search for encrypted data matching the query vector in the at least one shared tag knowledge base according to the vector search algorithm and the permission information, and obtain at least one candidate tag. The permission information in each candidate tag is used to indicate that the target tenant is allowed to access the candidate tag.

16. The apparatus according to any one of claims 13 to 15, characterized in that, The data management system also includes a local tag knowledge base for the target tenant. This local tag knowledge base includes tags for at least one sensitive data item of the target tenant. The tags for the target tenant's sensitive data include the following information: the encrypted data, the hierarchical information, the classification information, and rule information. The rule information is used to indicate the identification rules for the sensitive data. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, including: The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information.

17. The apparatus according to claim 16, characterized in that, The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information, including: The correction module is used to determine that the initial label of the target sensitive data does not include the rule information; The correction module is used to determine the rule information of the target sensitive data based on the rule information of the at least one candidate label, wherein the rule information of the target sensitive data is the same as the rule information in a candidate label; The correction module is used to search for rule information that matches the rule information of the target sensitive data in the local tag knowledge base of the target tenant according to the matching algorithm, and obtain the target tag. The matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to a first threshold. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the target label.

18. The apparatus according to claim 16, characterized in that, The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the at least one candidate label, the target tenant's local label knowledge base, and the rule information, including: The correction module is used to determine that the initial label of the target sensitive data includes the rule information; The correction module is used to determine the first matching degree between each candidate label and the initial label according to the matching algorithm; The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information.

19. The apparatus according to claim 18, characterized in that, The first matching degree between each candidate tag and the initial tag is obtained based on the second matching degree between the candidate tag and the initial tag, and the third matching degree between the candidate tag and the initial tag, wherein the second matching degree is the matching degree between the context information of the sensitive data of the candidate tag and the query vector, and the third matching degree is the matching degree between the rule information of the candidate tag and the rule information of the initial tag.

20. The apparatus according to claim 18 or 19, characterized in that, The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information, including: The correction module is used to determine the filtered candidate labels based on a first matching degree and a second threshold between each candidate label and the initial label, wherein the first matching degree between the filtered candidate labels and the initial label is greater than or equal to the second threshold. The correction module is used to obtain the rule information of the target sensitive data based on the rule information of the filtered candidate tags, wherein the rule information of the target sensitive data is the same as the rule information of the filtered candidate tag; The correction module is used to search for rule information similar to the rule information of the target sensitive data in the local tag knowledge base of the target tenant to obtain a target tag, wherein the matching degree between the rule information in the target tag and the rule information of the target sensitive data is greater than or equal to a first threshold. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the target label.

21. The apparatus according to claim 18 or 19, characterized in that, The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information, including: The correction module is used to determine that the first matching degree between each candidate label and the initial label is less than or equal to a second threshold and greater than or equal to a third threshold. The correction module is used to send suggestion information, which is used to indicate the hierarchical information and / or classification information recommended for the target sensitive data; The correction module is used to receive feedback information, which is used to indicate the hierarchical information and / or classification information of the target sensitive data that has been manually confirmed. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the feedback information.

22. The apparatus according to claim 18 or 19, characterized in that, The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the first matching degree between each candidate label and the initial label, the target tenant's local label knowledge base, and the rule information, including: The correction module is used to determine that the first matching degree between each candidate label and the initial label is less than or equal to a third threshold. The correction module is used to determine the hierarchical information and / or classification information of the target sensitive data based on the hierarchical information and / or classification information of the initial label of the target sensitive data.

23. The apparatus according to any one of claims 13 to 22, characterized in that, The device further includes: a cache module, The caching module is used to store the hierarchical information and / or classification information of the target sensitive data into the target tenant's local tag knowledge base.

24. The apparatus according to claim 23, characterized in that, The configuration interface module is also used to receive a second request message from the target tenant, the second request message including fourth indication information, the fourth indication information being used to indicate the target data source; The scanning module is further configured to identify sensitive data in the target data source according to the second request message, and obtain an initial label for the target sensitive data, wherein the initial label includes context information of the target sensitive data; The scanning module is further configured to search for tags similar to the initial tags of the target sensitive data in the local tag knowledge base of the target tenant according to the similarity algorithm, and obtain similar tags, wherein the similarity between the similar tags and the initial tags is greater than or equal to a fourth threshold. The scanning module is also used to obtain the hierarchical information and / or classification information of the target sensitive data based on the similar labels.

25. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute a computer program or instructions stored in the memory of the at least one computing device, so that the cluster of computing devices performs the method as described in any one of claims 1 to 12.

26. A computer program product comprising instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster performs the method as described in any one of claims 1 to 12.

27. A computer-readable storage medium, characterized in that, Includes a computer program or instructions, which, when executed by a cluster of computing devices, perform the method as described in any one of claims 1 to 12.

Images