Multi-level authorization and dynamic de-identification method for cross-institution data sharing

Abstract

The multi-level authorization and dynamic desensitization method for cross-agency data sharing relates to the technical field of cross-agency privacy computing and data security. Double-source secret state data and authorization labels are obtained, and two feature sets are obtained by decryption alignment. The correlation degree and feature overlap surge rate are calculated, and if both meet the risk judgment, the authorization strategy is updated to the target joint credential. According to the overlap surge rate, the target noise scale is generated, and the numerical value increases with the surge rate. Random bottom noise disturbance is applied to the initial output of the joint prediction model, and the final desensitized data is obtained. It can overcome the defect that the local static authorization in the prior art cannot perceive the sensitivity transition caused by cross-agency feature splicing, and is beneficial to improve the dynamic protection capability of sensitive combined features in the cross-agency joint computing scene.

Description

Technical Field

[0001] This application relates to the field of cross-organizational privacy computing and data security technology, specifically to a multi-level authorization and dynamic de-identification method for cross-organizational data sharing. Background Technology

[0002] In typical applications of cross-organizational collaborative computing, each participating organization usually performs static multi-level authorization and classification of data locally according to its own compliance rules, and assigns corresponding de-identification keys to different classifications. After receiving the encrypted data from each organization, the trusted execution environment strictly performs collaborative computing and de-identifies the results according to the local authorization label. Its core default assumption is that the sum of the local classification security of each organization is equal to the overall security of the collaborative computing.

[0003] However, under normal operating conditions, features from different institutions and locally labeled as low-sensitivity, when physically spliced ​​together in a trusted execution environment via the same user identifier, will experience a mathematical leap in information quantity in the statistical correlation dimension due to the high complementarity or overlap between the features. This results in the combined features carrying a far greater amount of identifiable information than when they exist individually, forming a sensitivity leap that cannot be predicted by local static rating. This is inherently mismatched with the assumption that local rating equals global security.

[0004] Because existing technologies fail to detect and intercept sensitivity shifts, they still mechanically execute local low-sensitivity de-identification strategies, resulting in privacy features being continuously output as low-sensitivity and compliant, weakening the defense against reverse engineering attacks. How to dynamically perceive sensitivity shifts caused by feature splicing during cross-organizational collaborative computing and adaptively increase de-identification strength to bridge the inherent gap between local static authorization and global collaborative security has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of this application is to provide a multi-level authorization and dynamic desensitization method for cross-organization data sharing, aiming to overcome the shortcomings of existing technologies where local static authorization cannot detect the sensitivity transition caused by cross-organization feature splicing, and to improve the dynamic protection capability of sensitive combined features in cross-organization joint computing scenarios.

[0006] The objective of this application can be achieved through the following technical solution: Firstly, a multi-level authorization and dynamic de-identification method for cross-organizational data sharing, comprising the following steps:

[0007] Obtain the first encrypted data and its first authorization tag from the first data source, and the second encrypted data and its second authorization tag from the second data source;

[0008] The first and second encrypted data are decrypted and aligned to generate a first feature set and a second feature set.

[0009] Obtain the correlation index between the first feature set and the second feature set, and obtain the feature overlap surge rate based on the correlation index and a preset reference benchmark value;

[0010] When the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, the authorization strategy for the current data will be updated to the target joint credential to cover the first authorization tag and the second authorization tag;

[0011] In response to the target joint credential, a corresponding target noise scale is generated based on the feature overlap burst rate, wherein the size of the target noise scale increases with the increase of the feature overlap burst rate;

[0012] The first feature set and the second feature set are input into a preset joint prediction model to output initial result data. Based on the target noise scale, a corresponding random background noise is generated, and the random background noise is used to perturb the initial result data to obtain the final desensitized data.

[0013] Secondly, a multi-level authorization and dynamic data anonymization system for cross-organizational data sharing includes the following modules:

[0014] The data acquisition module is used to acquire the first encrypted data and its first authorization tag transmitted from the first data source end, and the second encrypted data and its second authorization tag transmitted from the second data source end.

[0015] The processing module is used to decrypt and align the first and second encrypted data to generate a first feature set and a second feature set.

[0016] The feature extraction module is used to obtain the correlation index between the first feature set and the second feature set, and to obtain the feature overlap burst rate based on the correlation index and a preset reference benchmark value.

[0017] The update module is used to update the authorization strategy for the current data to the target joint credential when the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, so as to cover the first authorization tag and the second authorization tag.

[0018] A noise generation module is used to generate a corresponding target noise scale based on the feature overlap abrupt increase rate in response to the target joint credential, wherein the size of the target noise scale increases with the increase of the feature overlap abrupt increase rate;

[0019] The output module is used to input the first feature set and the second feature set into a preset joint prediction model to output initial result data, generate corresponding random background noise based on the target noise scale, and use the random background noise to perturb the initial result data to obtain the final desensitized data.

[0020] Thirdly, a computer storage medium stores computer-executable instructions, which, when executed, implement the multi-level authorization and dynamic desensitization method for cross-organizational data sharing described in the first aspect.

[0021] Compared with the prior art, the beneficial effects of this application are:

[0022] This application can dynamically sense the sensitivity shift caused by cross-institutional data splicing and adaptively improve the desensitization strength; it can complete the upgrade of authorization credentials and the adjustment of noise scale without human intervention; and it can improve the reverse inference defense capability against sensitive combined features while ensuring the availability of joint computing. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the steps of the multi-level authorization and dynamic de-identification method for cross-organizational data sharing in this application;

[0024] Figure 2 This is a schematic diagram of the modules of the multi-level authorization and dynamic de-identification system for cross-organizational data sharing proposed in this application. Detailed Implementation

[0025] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but only to illustrate selected embodiments of this application.

[0026] Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items. Therefore, once an item has been defined in one figure, it does not need to be further defined and explained in subsequent figures. The terms "first", "second", etc. are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0027] In typical application scenarios of cross-institutional collaborative computing, each participating institution performs static multi-level authorization and classification of data locally according to its own compliance rules. For example, features such as users' general consumption records and regular geographical locations are marked as low-sensitivity and assigned lightweight de-identification keys. After receiving the encrypted data from each institution, the trusted execution environment strictly performs joint risk control calculations and de-identifies the results according to the local authorization label. By default, the sum of the local security classifications of each institution is equivalent to the overall security of the collaborative computing.

[0028] When consumer preference characteristics labeled as low-sensitivity by organization A and geographic location characteristics labeled as low-sensitivity by organization B are concatenated using the same user identifier within a trusted execution environment, their high complementarity results in a significant information leap in the statistical correlation dimension, instantly forming a highly sensitive combination of characteristics that can be precisely located to a specific individual. Existing technologies separate multi-level authorization mechanisms from cross-organizational physical collaboration processes. Even if the aforementioned feature concatenation occurs, local low-sensitivity desensitization strategies are mechanically executed, failing to detect and intercept the sensitivity leap caused by the combined collision.

[0029] Because it is impossible to break through the rigid assumption that local static classification is equivalent to global security, high-frequency joint computing continues to result in high-value privacy features being output under the guise of low sensitivity and compliance, which substantially breaks through the bottom line of multi-level authorization, weakens the ability to defend against reverse engineering attacks, and has become a common compliance bottleneck in the industry that has long existed but is difficult to quantify.

[0030] Those skilled in the art have long been constrained by the technical inertia that the data source institution is best aware of its own data sensitivity. They generally believe that local authorization is the absolute basis for determining the data sensitivity level. In system design, they are also accustomed to decoupling the authorization verification control plane from the desensitized calculation data plane. Therefore, existing technologies have never attempted to question the continued effectiveness of local authorization in cross-institutional joint states, nor have they set up corresponding quantitative monitoring mechanisms for the collision distribution of physical characteristics in trusted execution environments.

[0031] Therefore, how to dynamically perceive the sensitivity shift caused by feature splicing and adaptively improve the desensitization strength during cross-institutional joint computing, thereby bridging the inherent gap between local static authorization and global joint security, has become an urgent technical problem to be solved.

[0032] Therefore, such as Figure 1 As shown, this application provides a multi-level authorization and dynamic de-identification method for cross-organizational data sharing, including the following steps:

[0033] Obtain the first encrypted data and its first authorization tag from the first data source, and the second encrypted data and its second authorization tag from the second data source;

[0034] The first and second encrypted data are decrypted and aligned to generate a first feature set and a second feature set.

[0035] Obtain the correlation index between the first feature set and the second feature set, and obtain the feature overlap surge rate based on the correlation index and a preset reference benchmark value;

[0036] When the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, the authorization strategy for the current data will be updated to the target joint credential to cover the first authorization tag and the second authorization tag;

[0037] In response to the target joint credential, a corresponding target noise scale is generated based on the feature overlap burst rate, wherein the size of the target noise scale increases with the increase of the feature overlap burst rate;

[0038] The first feature set and the second feature set are input into a preset joint prediction model to output initial result data. Based on the target noise scale, a corresponding random background noise is generated, and the random background noise is used to perturb the initial result data to obtain the final desensitized data.

[0039] In another implementation, such as Figure 2 As shown, this application also provides a multi-level authorization and dynamic de-identification system for cross-organizational data sharing, including the following modules:

[0040] The data acquisition module is used to acquire the first encrypted data and its first authorization tag transmitted from the first data source end, and the second encrypted data and its second authorization tag transmitted from the second data source end.

[0041] The processing module is used to decrypt and align the first and second encrypted data to generate a first feature set and a second feature set.

[0042] The feature extraction module is used to obtain the correlation index between the first feature set and the second feature set, and to obtain the feature overlap burst rate based on the correlation index and a preset reference benchmark value.

[0043] The update module is used to update the authorization strategy for the current data to the target joint credential when the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, so as to cover the first authorization tag and the second authorization tag.

[0044] A noise generation module is used to generate a corresponding target noise scale based on the feature overlap abrupt increase rate in response to the target joint credential, wherein the size of the target noise scale increases with the increase of the feature overlap abrupt increase rate;

[0045] The output module is used to input the first feature set and the second feature set into a preset joint prediction model to output initial result data, generate corresponding random background noise based on the target noise scale, and use the random background noise to perturb the initial result data to obtain the final desensitized data.

[0046] I. Acquisition of cross-organizational encrypted data and local authorized tags;

[0047] The inputs for this step are the encrypted data and their local authorization tags from the first and second data sources, respectively. The outputs are the first encrypted data, the first authorization tag, the second encrypted data, and the second authorization tag, which are used for subsequent decryption and alignment. By uniformly receiving encrypted data and tags from multiple organizations at the entry gateway of the trusted execution environment, a unified data entry point is provided for subsequent decryption alignment and correlation calculation.

[0048] Specifically, the present invention comprises a security scheduling daemon deployed in a trusted execution environment, which receives first encrypted data and its corresponding first authorization tag from a first data source and second encrypted data and its corresponding second authorization tag from a second data source through a secure channel.

[0049] Among them, the first authorization tag and the second authorization tag are multi-level security classification credentials pre-marked by the corresponding data source end according to local compliance rules, which are used to characterize the sensitivity level of the corresponding encrypted data from the perspective of its owning organization. The security scheduling daemon verifies the digital signature of the incoming data, confirms the legality of the data source, and then loads the first encrypted data, the first authorization tag, the second encrypted data and the second authorization tag into the isolated memory page of the trusted execution environment, waiting for subsequent steps to call.

[0050] In one optional implementation, both the first encrypted data and the second encrypted data are encapsulated using a symmetric encryption algorithm in conjunction with a session key pre-negotiated between their respective data sources and the trusted execution environment before entering the trusted execution environment. They always exist in binary ciphertext form in the external memory and network transmission bus. The security scheduling daemon only verifies the digital signature and source identifier of the ciphertext at the entry gateway and does not perform any decryption operations at the entry gateway, thereby ensuring that the sensitive data remains in encrypted form during the transmission across institutional boundaries until it enters the isolated memory area corresponding to the next step before decryption is allowed.

[0051] The negotiation of the session key is based on the remote authentication mechanism of the Trusted Execution Environment: before transmitting encrypted data, each data source verifies whether the measurement value and runtime state of the Trusted Execution Environment are consistent with expectations. Only after confirming that the accessed environment is indeed a legitimate and tamper-free isolated environment can the session key be negotiated with it, thereby ensuring that both the first and second data sources can securely transmit their encrypted data to the same Trusted Execution Environment without trusting the other party's organization.

[0052] II. Decryption and alignment of dense-state data to generate feature sets;

[0053] The inputs for this step are the first and second encrypted data output above, and the outputs are the first and second feature sets after decryption and alignment. Cross-institutional data are aligned using a combination of privacy-preserving intersection and source-specific decryption, generating a structured feature set that can be used for subsequent correlation calculations without exposing non-shared customer information.

[0054] Specifically, the present invention extracts a first identifier feature sequence from the first encrypted data and a second identifier feature sequence from the second encrypted data. The first and second identifier feature sequences are one-dimensional sequences composed of fields that can uniquely identify entities. Privacy intersection processing is performed based on the one-way hash values ​​of the first and second identifier feature sequences to determine the first and second intersection data that are successfully matched in the first encrypted data and the second intersection data that are successfully matched in the second encrypted data. Unmatched memory data is removed, and the first and second intersection data are decrypted into plaintext data to generate the first and second feature sets respectively.

[0055] In one optional implementation, the first feature set corresponds to a mathematical matrix consisting of the number of intersecting entities and the first institutional feature dimension, and the second feature set corresponds to a mathematical matrix consisting of the number of intersecting entities and the second institutional feature dimension. The entity rows of the two correspond one-to-one according to the index determined in the privacy intersection stage.

[0056] It should be noted that before decryption, the first and second encrypted data are stored separately in isolated memory using their respective institution's keys. They cannot be directly merged and processed at the physical level. Only after the intersection of data belonging to the same entity is decrypted into plaintext values ​​using the corresponding institution's keys can they be horizontally concatenated in memory according to entity indexes to enter the subsequent correlation calculation process. Therefore, in this invention, there is a direct causal relationship between the decryption operation and the generation of the feature set, rather than a simple information reading. Furthermore, since the privacy intersection process completes the division of intersection and non-intersection before decryption, unmatched data is removed from the isolated memory before plaintext processing, avoiding the engineering risk of the isolated memory capacity being instantly exhausted due to the simultaneous decryption of massive amounts of non-intersection data.

[0057] The reason why this invention uses one-way hash values ​​of identifier feature sequences for comparison, rather than directly comparing plaintext identifiers in isolated memory, is to prevent one organization from obtaining the identifier information of the other organization's unique customers through joint computing processes. Because one-way hash operations have the characteristics that the same input will inevitably produce the same output, and it is difficult to deduce the input from the output, the identifier feature sequences on both sides complete the hash transformation locally before entering the isolated memory for comparison. Even if an accidental memory-level leakage occurs, only the irreversible hash value is leaked, not the real identifier. Thus, while completing cross-organizational entity alignment, the identity information of non-intersecting customers is always restricted to their own organization, and no customer existence information beyond the intersection range will be leaked to the other organization.

[0058] III. Quantification of feature set correlation index and feature overlap burst rate;

[0059] The inputs to this step are the first and second feature sets output above, and the outputs are the correlation index and feature overlap surge rate, which characterize the correlation strength of the current batch of data. By calculating the difference between the local Pearson correlation coefficient and the historical smoothed baseline, the static overlap state of cross-institutional features is transformed into a monitorable quantitative indicator, providing a basis for subsequent authorization.

[0060] Specifically, this invention performs data slicing processing on the first feature set and the second feature set based on a preset number of samples to obtain the first feature subset and the second feature subset corresponding to the current batch, and obtains the correlation index between the first feature subset and the second feature subset, the calculation relationship of which is as follows:

[0061] ;

[0062] In the formula, The correlation index, For the first feature subset, the first Each feature element The local mean of the first feature subset. For the second feature subset, the first Each feature element This is the local mean of the second feature subset. The preset number of samples.

[0063] In one alternative implementation, considering the limited capacity of isolated memory within the trusted execution environment, the data slicing process does not load the entire feature set into isolated memory at once. Instead, it opens a fixed-length sliding window with the preset number of samples as the step size, loads the data in the window into the processor's vector extension register through direct memory access, and calls vector parallel computing instructions. During the process of traversing the data in the current window, only five state accumulators are maintained: the first feature sum, the second feature sum, the first feature square sum, the second feature square sum, and the feature product sum.

[0064] After the current window is traversed, the local mean and the correlation index are calculated using the accumulator mentioned above. Then, the window data is released to load the next batch, thereby compressing the space overhead of calculating the correlation index to a constant level and avoiding isolated memory overflow caused by loading a massive feature set at once.

[0065] The correlation index ranges from -1 to +1. A value closer to 0 indicates less correlation between the two sets of features in terms of physical distribution, while an absolute value closer to 1 indicates a strong information binding relationship in mathematical space, regardless of whether the two sets of features are positively or negatively correlated. This invention uses an absolute value for the correlation index to eliminate the directionality of feature correlation, retaining only the correlation strength and avoiding the risk of overlooking reverse inferences arising from negative correlations.

[0066] Read the historical correlation index sequence that is pre-stored in isolated memory, and obtain the exponential moving average value corresponding to the historical correlation index sequence, and use the exponential moving average value as a preset reference benchmark value;

[0067] Obtain the absolute value of the correlation index, and use the difference between the absolute value and the preset reference benchmark value as the feature overlap surge rate. The calculation relationship is as follows:

[0068] ;

[0069] In the formula, The feature overlap abrupt increase rate, This refers to the exponential moving average. The exponential moving average is obtained by iteratively updating the historical correlation index, and its calculation relationship is as follows:

[0070] ;

[0071] In the formula, This is the updated exponential moving average. To preset the smoothing weight factor, The correlation index is from the previous batch. This is the exponential moving average before the update. Because this iterative method only needs to store a single value in isolated memory to complete the baseline update, it avoids the storage overhead required to store the complete historical sequence. At the same time, it enables the system to smoothly absorb short-term business fluctuations and has a sensitive response capability to sudden targeted probing attacks.

[0072] In one optional implementation, the preset smoothing weight factor ranges from 0.05 to 0.2. The larger the value, the more sensitive the exponential moving average is to the latest batch of data; the smaller the value, the more dependent the exponential moving average is on the historical baseline. Staff can calibrate this parameter according to the fluctuation characteristics of data overlap in specific business scenarios.

[0073] Specifically, if the overlap of cross-organizational data changes slowly and continuously with the business cycle, the exponential moving average will slowly rise or fall accordingly, continuously absorbing such natural fluctuations into the preset reference benchmark value, so that the feature overlap surge rate calculated based on the correlation index and the preset reference benchmark value remains at a small level, thereby avoiding misjudging normal business homogenization phenomena as splicing risks.

[0074] Conversely, if a malicious organization injects a probe sample with a specific structure into a certain batch, causing the correlation index to fluctuate drastically in a short period of time, far exceeding the historical norm, the feature overlap surge rate will increase significantly due to the lag in the response of the preset reference benchmark to historical data, thus providing a trigger for risk assessment in the next step.

[0075] IV. Multi-level authorization and global dynamic arbitration based on splicing risk assessment conditions;

[0076] The inputs for this step are the correlation index and feature overlap surge rate from the above outputs, and the output is the memory control block status after the authorization tag upgrade. Through state machine determination and forced overwriting of the memory control block permission description field, data meeting the concatenation risk conditions is upgraded from local static authorization to the highest security level global federated credential.

[0077] Specifically, when the absolute value of the correlation index is greater than a first preset judgment threshold and the feature overlap surge rate is greater than a second preset judgment threshold, the present invention determines that the two meet the preset splicing risk judgment conditions and generates an authorization stripping instruction to be sent to the memory management unit; the memory management unit overwrites the memory pointer addresses where the first authorization tag and the second authorization tag are located, and writes the target combined credential representing the highest security level into the permission description field corresponding to the memory control block to complete the update of the authorization policy.

[0078] In one optional implementation, the operation of overwriting the memory pointer address and writing the target combined credential is implemented by the security monitor of the trusted execution environment intervening in the extended page table: the security monitor triggers a hardware interrupt to suspend the current computing thread, locates the physical memory pages corresponding to the first authorization tag and the second authorization tag, modifies the access control bits in the extended page table entries to remove the original read-only attribute, and atomically writes the target combined credential into the permission description field corresponding to the memory control block through a memory barrier instruction, thereby ensuring the atomicity and immutability of authorization state transitions in a multi-core concurrent environment.

[0079] Before being written, the target credential is instantiated by the security monitor in the privileged memory area as machine code carrying a high-intensity noise-adding instruction identifier, and bound to the thread control block corresponding to the memory control block. This ensures that any computing thread that subsequently reads the memory control block can recognize the upgraded authorization status, avoiding inconsistent permission status due to concurrent access by multiple threads.

[0080] If the correlation index and the feature overlap surge rate do not simultaneously meet the preset splicing risk judgment conditions, the memory control block retains the first authorization tag and the second authorization tag, does not perform the operation of writing the target joint certificate, and the data continues to flow according to the local original classification, thereby retaining the original authorization judgment of the data source institution under normal working conditions where no splicing risk occurs.

[0081] It should be noted that the operation of overwriting the memory pointer address and writing the target joint credential described in this invention is not a normal variable assignment at the application layer, but a privileged operation that goes deep into the memory management unit and hardware page table level. It is completed by modifying the access control bits of the extended page table entries and cooperating with hardware interrupts and memory barrier instructions, so that the upgrade of the authorization state is irreversible at the physical memory level. Any attempt to bypass the memory control block and directly read the original encrypted data will be intercepted by the access control mechanism of the trusted execution environment due to the lack of matching of the corresponding permission description field. This ensures that the multi-level authorization global dynamic arbitration is real and reliable at the engineering implementation level, rather than just remaining at the logical judgment level.

[0082] Meanwhile, since the overwrite operation occurs at the physical page level of memory rather than the application layer cache level, even if the computing task is abnormally interrupted or migrated to other processing cores after authorization upgrade, the rescheduled computing thread can still identify the upgraded target joint credential and continue the established high-intensity desensitization path when reading the same memory control block, thus avoiding the risk of authorization status rollback due to task migration or abnormal restart.

[0083] V. Generation of target noise scale for response target joint credentials;

[0084] The inputs to this step are the memory control block permission status and the feature overlap surge rate mentioned above. The output is the target noise scale for the dynamic desensitization engine to use. By using the difference between the feature overlap surge rate and the preset tolerance threshold as a power-law benchmark for nonlinear amplification, the noise scale increases exponentially with the increase of splicing risk, while ensuring that the noise scale is maintained at a basic level under normal operating conditions.

[0085] Specifically, in response to detecting the target joint credential in the permission description field, the present invention uses the difference between the feature overlap surge rate and the preset tolerance threshold as a power exponent benchmark, and performs an exponential amplification operation using preset basic noise parameters and scaling factor parameters to generate a corresponding target noise scale, the calculation relationship of which is as follows:

[0086] ;

[0087] In the formula, Let be the target noise scale. The basic noise parameters are as follows. It is a natural constant. The scaling factor parameter is... The feature overlap abrupt increase rate, This is a preset tolerance threshold.

[0088] When the feature overlap surge rate does not exceed the preset tolerance threshold, the power exponent is zero, the target noise scale is equal to the basic noise parameter, and the system maintains the calculation accuracy under normal operating conditions; when the feature overlap surge rate exceeds the preset tolerance threshold, the power exponent increases with the difference, and the target noise scale increases exponentially and monotonically, thereby realizing that the size of the target noise scale increases with the increase of the feature overlap surge rate.

[0089] The reason why this invention uses exponential amplification instead of nonlinear amplification to calculate the target noise scale is that if a linear mapping relationship is used, when the feature overlap surge rate is at an extremely high level, the increase in the noise scale is very limited, and malicious organizations can still gradually extract privacy features by repeatedly initiating differential comparison queries. However, with the exponential amplification relationship, when the feature overlap surge rate only slightly exceeds the preset tolerance threshold, the target noise scale grows slowly, maximizing the data availability under normal working conditions. Once the feature overlap surge rate experiences a drastic jump far exceeding the preset tolerance threshold, the target noise scale will exhibit an avalanche-like growth, causing the output results to be fully submerged by a large amount of random background noise, thereby achieving a strong deterrent against malicious differential detection.

[0090] VI. Joint prediction calculation, dynamic desensitization perturbation processing, and output;

[0091] The inputs to this step are the first feature set, the second feature set, and the target noise scale from the above outputs. The output is the final desensitized data after dynamic desensitization processing. By splitting the execution path of joint prediction according to the target noise scale and injecting physical random noise into the least significant bit of the result data, the microscopic combination boundary of cross-institutional data is masked while ensuring the availability of joint computation.

[0092] Specifically, when the target noise scale is less than or equal to a preset trigger threshold, the present invention performs the operation of inputting the first feature set and the second feature set into a preset joint prediction model to output initial result data.

[0093] When the target noise scale is greater than a preset trigger threshold, the operation of inputting the first feature set and the second feature set into a preset joint prediction model is suspended, and a preset proxy dimensionality reduction model is invoked to perform principal component extraction processing on the first feature set and the second feature set to generate a first dimensionality reduction feature vector and a second dimensionality reduction feature vector. Based on a preset feature weight matrix, a weighted summation processing is performed on the first dimensionality reduction feature vector and the second dimensionality reduction feature vector to generate a linear prediction result, and the linear prediction result is used as the initial result data.

[0094] In one optional implementation, the preset joint prediction model is a deep feedforward neural network, whose network topology sequentially includes a feature concatenation layer for splicing tensors from different sources in the memory dimension, at least two multi-level fully connected hidden layers, each followed by a batch normalization operator and a nonlinear activation function, and an output layer that outputs a probability distribution using a nonlinear function.

[0095] The feature cascade layer will have a dimension of The first feature set and dimension are The second feature set is concatenated along the feature dimension to generate a dimension of The global feature vector is input to the multi-level fully connected hidden layer, where the calculation relationship of the first hidden layer is as follows:

[0096] ;

[0097] In the formula, This is the output vector of the first hidden layer. This is the weight matrix of the first hidden layer in the pre-trained system. For the global feature vector, This is the bias vector for the first hidden layer. This is a non-linear activation function. After layer-by-layer forward propagation through the multi-level fully connected hidden layers, the output layer maps the deep representation vectors into a probability distribution, which serves as the initial result data.

[0098] The preset surrogate dimensionality reduction model consists of a set of orthogonal projection matrices pre-calibrated by principal component analysis. The weighted summation process is performed by a linear regression operator, and the calculation relationship is as follows:

[0099] ;

[0100] ;

[0101] ;

[0102] In the formula, For the first feature set, For the second feature set, , These are the pre-calibrated projection matrices of the first and second principal components, respectively. This is the first dimensionality-reduced feature vector. This is the second dimensionality-reduced feature vector. The feature weight matrix is... For linear bias, This refers to the linear prediction result.

[0103] When the target noise scale is small, the deep feedforward neural network is run at full power to obtain high-precision initial result data; when the target noise scale is large, since high-intensity noise will be injected later, a lightweight orthogonal projection and linear regression link is called to generate the linear prediction result and use it as the initial result data, so as to avoid wasting front-end computing power on microscopic precision that is about to be masked by noise.

[0104] The physical meaning of the preset trigger threshold is that if the target noise scale is already at an extremely high level, even if a high-complexity deep feedforward neural network is used to calculate a high-precision result, the precision will be greatly weakened in the subsequent process of superimposing random background noise. At this time, continuing to invest heavy computing power can no longer bring matching business benefits. Therefore, this invention compares the target noise scale with the preset trigger threshold to match the level of computing power investment with the subsequent desensitization intensity, thereby realizing the dynamic optimization configuration of computing power resources.

[0105] A physical random number conforming to the target noise scale is obtained as a random noise floor. The random noise floor is superimposed on the least significant bit of the matrix element corresponding to the initial result data to obtain the final desensitized data. The final desensitized data is encrypted and encapsulated to generate a corresponding output ciphertext sequence. The output ciphertext sequence is sent to the receiving end.

[0106] In one optional implementation, the physical random number is a uniformly distributed random number generated by a hardware true random number generator based on a physical entropy source, invoked by the trusted execution environment, and then sampled and mapped to a random noise floor conforming to a Laplace distribution after inverse transformation. The mapping relationship is as follows:

[0107] ;

[0108] In the formula, The random noise floor, Uniformly distributed random numbers generated by the hardware true random number generator. For symbolic functions, The target noise scale is defined as follows. The process of superimposing to the least significant bit specifically involves:

[0109] The initial result data is deconstructed into a register in floating-point format to extract the sign bit, exponent, and mantissa from the corresponding matrix elements. The length of the lower bit of the mantissa to be perturbed is dynamically determined according to the target noise scale. The random noise floor quantization is truncated into a binary noise floor mask of the corresponding length, and then bitwise operations are performed with the least significant bit segment of the mantissa. The final desensitized data is reassembled while keeping the sign bit and exponent unchanged, thereby masking the microscopic values ​​of the matrix elements while preserving their macroscopic exponent accuracy.

[0110] In one optional implementation, after the output ciphertext sequence is sent to the receiving end, the security scheduling daemon further triggers a hardware-level memory destruction subroutine to perform overwrite and zeroing processing on the static random access memory and dynamic random access memory physical pages that have passed through the first feature set, the second feature set, and the initial result data.

[0111] The first round of overwriting is performed using an all-zero bit stream, and the second round of overwriting is performed using a pseudo-random bit stream generated by a hardware random number generator. This reduces the risk of sensitive data remaining in the chip's storage unit in the form of physical residual magnetism, and further enhances the security protection capability of this invention at the end of the data lifecycle.

[0112] The above six steps constitute a complete causal closed loop from cross-institutional dense state data acquisition, to feature correlation quantification, to authorized arbitration and noise scale coupling, and finally to joint prediction and desensitized perturbation output. The output of each step is directly used as the input of the next step. There is no discontinuity in the flow of data between the steps. Moreover, the non-innovative general computer operations involved in each step have been given engineering details that can be directly implemented by those skilled in the art, combined with the specific software and hardware mechanisms of the trusted execution environment.

[0113] The Trusted Execution Environment (TEE), memory management unit, and extended page table mechanism involved in the above six steps are all existing mature computer hardware and operating system capabilities. The solution of this invention can be directly compatible with mainstream TEE hardware platform deployment. The vectorized covariance operation can be implemented using the processor's existing vector extended instruction set. The authorization arbitration module resides as a lightweight daemon process in the memory scheduling layer of the TEE operating system. Compared with the heavyweight multi-party secure computation network communication overhead, it is negligible and can be deployed and implemented without the introduction of additional dedicated hardware.

[0114] Through the above technical solutions, the present invention can achieve the following technical effects:

[0115] To address the shortcomings of existing technologies where local static authorization cannot detect sensitivity transitions caused by cross-agency feature splicing, this invention achieves dynamic perception of sensitivity transitions caused by joint collisions by calculating the correlation index and feature overlap surge rate of cross-agency feature sets.

[0116] To address the flaw that the rigid assumption of local static classification being equivalent to global security leads to the breach of the multi-level authorization bottom line, this invention updates the authorization strategy to the target joint credential when the splicing risk judgment condition is met, thereby completing the global dynamic dimensional upgrade of the authorization tag without manual intervention.

[0117] To address the shortcomings of existing technologies that fix the desensitization intensity, leading to a disconnect between noise and risk levels, this invention achieves a significant improvement in the reverse inference defense capability against cross-institution sensitive combination features by exponentially and nonlinearly coupling the target noise scale with the feature overlap surge rate.

[0118] To address the issue that high-intensity noise injection leads to unnecessary waste of computing power in the front-end high-computing-power prediction model, this invention optimizes computing resources dynamically by splitting the execution path of the joint prediction model according to the target noise scale, thereby ensuring the availability of joint computing.

[0119] To address the issue that pseudo-random number generators may be reverse engineered, leading to unreliable desensitized background noise, this invention generates physical random background noise by calling a hardware true random number generator and superimposing it onto the least significant bit of the result data. This approach masks the microscopic combination boundaries of cross-institutional data while preserving the macroscopic accuracy of the result data.

[0120] To address the risk of leakage caused by sensitive intermediate data remaining in the memory chip as physical residual magnetism at the end of the data lifecycle, this invention performs a double-round overwrite and zeroing process on the relevant physical memory pages after the result is output, thereby further compressing the recoverable window of sensitive data.

[0121] In another embodiment, this application also provides a computer storage medium storing computer-executable instructions, which, when executed, implement the aforementioned multi-level authorization and dynamic desensitization method for cross-organizational data sharing.

[0122] The above embodiments are only used to illustrate the technical methods of this application and are not intended to limit it. Although this application has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of this application without departing from the spirit and scope of the technical methods of this application.

Claims

1. A multi-level authorization and dynamic de-identification method for cross-organizational data sharing, characterized in that: Includes the following steps: Obtain the first encrypted data and its first authorization tag from the first data source, and the second encrypted data and its second authorization tag from the second data source; The first and second encrypted data are decrypted and aligned to generate a first feature set and a second feature set. Obtain the correlation index between the first feature set and the second feature set, and obtain the feature overlap surge rate based on the correlation index and a preset reference benchmark value; When the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, the authorization strategy for the current data will be updated to the target joint credential to cover the first authorization tag and the second authorization tag; In response to the target joint credential, a corresponding target noise scale is generated based on the feature overlap burst rate, wherein the size of the target noise scale increases with the increase of the feature overlap burst rate; The first feature set and the second feature set are input into a preset joint prediction model to output initial result data. Based on the target noise scale, a corresponding random background noise is generated, and the random background noise is used to perturb the initial result data to obtain the final desensitized data.

2. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 1, characterized in that, The process of generating the first feature set and the second feature set includes: Based on the first dense state data and the second dense state data, extract the first identifier feature sequence and the second identifier feature sequence respectively; A privacy intersection process is performed on the one-way hash values ​​of the first identifier feature sequence and the second identifier feature sequence to obtain a first intersection data and a second intersection data that match each other in the first secret state data and the second secret state data; The first intersection data and the second intersection data are decrypted into plaintext data to generate the first feature set and the second feature set accordingly.

3. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 1, characterized in that, The process of obtaining correlation metrics includes: Based on a preset sample size Data slicing is performed on the first feature set and the second feature set to obtain the first feature subset and the second feature subset corresponding to the current batch, and the correlation index between the first feature subset and the second feature subset is obtained. ; ； in, For the first feature subset, the first Each feature element The local mean of the first feature subset. For the second feature subset, the first Each feature element It is the local mean of the second feature subset.

4. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 3, characterized in that, The process of obtaining the feature overlap burst rate includes: Read the historical correlation index sequence pre-stored in isolated memory and obtain the exponential moving average corresponding to the historical correlation index sequence. The exponential moving average is used as a preset reference benchmark value; Obtain the absolute value of the correlation index. The difference between the absolute value and the preset reference value is used as the feature overlap burst rate. ; 。 5. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 1, characterized in that, The process of updating the authorization policy to the target federated credential includes: When the absolute value of the correlation index is greater than the first preset judgment threshold and the feature overlap surge rate is greater than the second preset judgment threshold, it is determined that the two meet the preset splicing risk judgment conditions, and an authorization stripping instruction is generated and sent to the memory management unit. The memory management unit overwrites the memory pointer addresses where the first authorization tag and the second authorization tag are located, and writes the target combined credential representing the highest security level into the permission description field corresponding to the memory control block to complete the authorization policy update.

6. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 5, characterized in that, The process of generating the target noise scale includes: In response to detecting the target combined credential in the permission description field, the feature overlap surge rate is... With preset tolerance threshold The difference is used as the power exponent benchmark, and a preset base noise parameter is used. With scaling factor parameter Perform an exponential amplification operation to generate the corresponding target noise scale. ; 。 7. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 1, characterized in that, After generating the target noise scale, the following steps are also included: When the target noise scale is less than or equal to a preset trigger threshold, the operation of inputting the first feature set and the second feature set into a preset joint prediction model to output initial result data is performed. When the target noise scale is greater than a preset trigger threshold, the operation of inputting the first feature set and the second feature set into the preset joint prediction model is suspended, and the preset proxy dimensionality reduction model is called to perform principal component extraction processing on the first feature set and the second feature set to generate the first dimensionality reduction feature vector and the second dimensionality reduction feature vector. Based on a preset feature weight matrix, a weighted summation process is performed on the first dimensionality-reduced feature vector and the second dimensionality-reduced feature vector to generate a linear prediction result, which is then used as the initial result data.

8. The multi-level authorization and dynamic de-identification method for cross-organizational data sharing according to claim 1, characterized in that, The process of obtaining the final anonymized data includes: A physical random number conforming to the target noise scale is obtained as a random noise floor. The random noise floor is superimposed on the least significant bit of the matrix element corresponding to the initial result data to obtain the final desensitized data. The final desensitized data is encrypted and encapsulated to generate a corresponding output ciphertext sequence. The output ciphertext sequence is sent to the receiving end.

9. A multi-level authorization and dynamic data anonymization system for cross-organizational data sharing, characterized in that: Includes the following modules: The data acquisition module is used to acquire the first encrypted data and its first authorization tag transmitted from the first data source end, and the second encrypted data and its second authorization tag transmitted from the second data source end. The processing module is used to decrypt and align the first and second encrypted data to generate a first feature set and a second feature set. The feature extraction module is used to obtain the correlation index between the first feature set and the second feature set, and to obtain the feature overlap burst rate based on the correlation index and a preset reference benchmark value. The update module is used to update the authorization strategy for the current data to the target joint credential when the correlation index and the feature overlap surge rate both meet the preset splicing risk judgment conditions, so as to cover the first authorization tag and the second authorization tag. A noise generation module is used to generate a corresponding target noise scale based on the feature overlap abrupt increase rate in response to the target joint credential, wherein the size of the target noise scale increases with the increase of the feature overlap abrupt increase rate; The output module is used to input the first feature set and the second feature set into a preset joint prediction model to output initial result data, generate corresponding random background noise based on the target noise scale, and use the random background noise to perturb the initial result data to obtain the final desensitized data.

10. A computer storage medium storing computer-executable instructions, characterized in that, When the computer-executable instructions are executed, they implement the multi-level authorization and dynamic de-identification method for cross-organizational data sharing as described in any one of claims 1-8.

Images