Computer data desensitization computing method based on trusted execution environment

Abstract

The present invention provides a computer data desensitization computing method based on a trusted execution environment, relating to the field of computer data processing technology. The method utilizes a hardware security module to create an isolated trusted domain, achieves secure data transmission via asymmetric encryption, and completes rule matching and computation for desensitization within encrypted memory. It supports multiple types of desensitization strategies including masking replacement, entity hiding, and field offset. Compared to traditional software-based desensitization solutions, the method improves single batch data processing efficiency by more than 65%, achieving a balance between hardware-level security protection and high-performance computing. Additionally, built-in encrypted audit logs meet compliance requirements. The method is widely applicable to scenarios involving sensitive data processing in finance, e-commerce, and healthcare, addressing security risks in traditional desensitization technologies such as memory leakage and rule tampering.

Description

A Computer Data De-identification Computation Method Based on Trusted Execution Environment Technical Field

[0001] This invention relates to the field of computer data processing technology, and more specifically, to a computer data de-identification calculation method based on a trusted execution environment. Background Technology

[0002] With the widespread application of big data and cloud computing, the value of data as a core asset is becoming increasingly prominent, but data security and privacy protection issues are also becoming more severe. Most existing data anonymization methods are executed in traditional computing environments, posing numerous security risks: on the one hand, the computing resources upon which the anonymization process relies may be tampered with by malicious attackers, leading to the bypassing or alteration of anonymization rules and the leakage of sensitive data; on the other hand, data is processed in plaintext in memory during the anonymization process, posing a risk of being stolen by memory sniffing attacks. Furthermore, traditional anonymization methods struggle to balance anonymization effectiveness with computational efficiency; complex anonymization rules often result in high computational overhead, impacting business processing speed.

[0003] Trusted Execution Environment (TEE) is a hardware-based security technology that creates an isolated, protected execution zone within a device, ensuring that code and data remain encrypted throughout processing and allowing only authorized code access. How to effectively combine TEE with data anonymization techniques to improve the security and efficiency of data anonymization has become a pressing issue. Therefore, this paper proposes a computational method for computer data anonymization based on TEE. Summary of the Invention

[0004] This invention provides the following technical solution: a computer data desensitization calculation method based on a trusted execution environment, comprising the following steps: Step 1: creating a trusted execution environment instance based on a hardware security module, generating an environment identity key pair, and deploying a secure boot verification mechanism and an encrypted memory area within the trusted execution environment;

[0005] Step 2: The external business system preprocesses the data to be de-identified containing sensitive fields, encrypts the data to be de-identified using the public key of the Trusted Execution Environment (TEE) and generates a transmission data packet, which is then sent to the TEE through a secure channel.

[0006] Step 3: The trusted execution environment decrypts the plaintext data to be de-identified and matches the de-identification rules for the corresponding sensitive fields from the pre-stored de-identification rule set;

[0007] Step 4: Perform de-identification calculations within the encrypted memory area of ​​the trusted execution environment, encrypting intermediate data in real time to generate de-identified data and corresponding verification values;

[0008] Step 5: Encrypt and export the anonymized data and verification value to the external business system. The external system verifies the data integrity before putting it into business use.

[0009] Preferably, in step 1, the hardware security module includes any one of Intel SGX, ARM TrustZone, or AMD SEV, and the private key in the environment identity key pair is stored only within the trusted execution environment, accessible only to authorized de-identified computation code.

[0010] Preferably, in step 2, the preprocessing process includes: cleaning redundant and invalid data, identifying sensitive field types and marking desensitization rule identifiers, transmitting data packets containing encrypted data to be desensitized and plaintext desensitization rule identifiers, and constructing a secure channel based on the TLS 1.3 protocol.

[0011] Preferably, in step 3, the de-identification rule set is stored in the encrypted memory area of ​​the trusted execution environment in a pre-compiled manner, including at least two standard de-identification algorithms among masking algorithm, replacement algorithm, offset algorithm, and randomization algorithm, and also supports custom de-identification rule interfaces.

[0012] Preferably, in step 4, the intermediate computation data is encrypted in real time using the hardware encryption engine built into the Trusted Execution Environment. The encryption key is dynamically generated by the Trusted Execution Environment during the initialization phase and exists only within the trusted memory region.

[0013] Preferably, the trusted execution environment generates de-identified audit logs, and the log data includes the de-identification initiation time. Data processing volume Success rate of desensitization rule matching ,in The number of sensitive fields that successfully match the rules; audit logs are encrypted and stored using the AES-256 algorithm, with the key derived from the environment identity key pair: ,in For hash-based key derivation functions, This is the preset salt value.

[0014] Preferably, the secure startup verification mechanism in step 1 uses a hash algorithm to perform integrity verification on the de-identified computation code loaded into the trusted execution environment. If the verification fails, the code execution is terminated and a security alarm is triggered.

[0015] Preferably, the trusted execution environment supports a remote authentication mechanism, providing trusted authentication of the environment's identity and code integrity to external business systems. Data transmission is only initiated after the external system has verified the authentication. Beneficial effects

[0016] The beneficial effects of this invention are: relying on the hardware-level isolation characteristics of the Trusted Execution Environment, the entire data desensitization process is conducted in an encrypted execution environment, effectively preventing memory sniffing and code tampering attacks, and ensuring the security of sensitive data during processing, storage and transmission.

[0017] This invention reduces the additional overhead of de-identification calculation by using a pre-compiled de-identification rule set and a hardware encryption engine to accelerate calculation. Compared with traditional software de-identification methods, the calculation efficiency is improved by more than 30%.

[0018] This invention features a built-in audit log mechanism that enables full-process traceability of the de-identification process. It supports custom de-identification rule interfaces, allowing for rapid adaptation to personalized de-identification needs based on different business scenarios. It is also compatible with various hardware trusted execution environment standards, making it widely applicable. Attached Figure Description

[0019] Figure 1 is a schematic data block diagram of the desensitization rule types provided by the present invention;

[0020] Figure 2 is a data block diagram comparing the security features of the Trusted Execution Environment provided by the present invention;

[0021] Figure 3 is a data flowchart comparing the time consumption of the desensitization process provided by the present invention. Embodiments of the present invention

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention.

[0023] Example 1: A computer data desensitization calculation method based on a trusted execution environment, Step 1: Create a trusted execution environment instance based on a hardware security module, generate an environment identity key pair, and deploy a secure boot verification mechanism and an encrypted memory area within the trusted execution environment;

[0024] Step 2: The external business system preprocesses the data to be de-identified containing sensitive fields, encrypts the data to be de-identified using the public key of the Trusted Execution Environment (TEE) and generates a transmission data packet, which is then sent to the TEE through a secure channel.

[0025] Step 3: The trusted execution environment decrypts the plaintext data to be de-identified and matches the de-identification rules for the corresponding sensitive fields from the pre-stored de-identification rule set;

[0026] Step 4: Perform de-identification calculations within the encrypted memory area of ​​the trusted execution environment, encrypting intermediate data in real time to generate de-identified data and corresponding verification values;

[0027] Step 5: Encrypt and export the anonymized data and verification value to the external business system. The external system verifies the data integrity before putting it into business use.

[0028] In step 3, the de-identification rule set is stored in the encrypted memory area of ​​the trusted execution environment in a pre-compiled manner. It includes at least two standard de-identification algorithms from the masking algorithm, replacement algorithm, offset algorithm, and randomization algorithm, and also supports custom de-identification rule interfaces.

[0029] In step 4, the desensitization calculation process adapts the corresponding algorithm to different sensitive field types:

[0030] For sensitive fields such as mobile phone numbers and bank card numbers, a masking algorithm is used to retain some feature information and then replace the remaining fields.

[0031] For structured sensitive fields such as ID card number and date of birth, an offset algorithm is used to randomly offset the field value within a preset range while retaining the validity of the verification.

[0032] For unstructured sensitive text fields, a replacement algorithm is used to replace sensitive entities with generic placeholders.

[0033] In step 4, the hardware encryption engine built into the Trusted Execution Environment is used to encrypt the intermediate computation data in real time. The encryption key is dynamically generated by the Trusted Execution Environment during the initialization phase and exists only within the trusted memory area.

[0034] In step 5, the de-identified data and the verification value are transmitted through the secure export interface of the Trusted Execution Environment. Before transmission, the Trusted Execution Environment public key is used for lightweight encryption. The external business system verifies the integrity of the de-identified data through the verification value, which is generated based on the SM3 or SHA-256 hash algorithm.

[0035] Step 6: Generate de-identified audit logs within the trusted execution environment. The log information includes de-identification time, amount of data processed, de-identification rule type, and computation time. The audit logs are stored in encrypted form in a separate audit partition of trusted memory and are periodically exported to a secure storage server for compliance auditing.

[0036] A secure startup verification mechanism uses a hash algorithm to perform integrity verification on the anonymized computational code loaded into the trusted execution environment. If the verification fails, code execution is terminated and a security alert is triggered. The trusted execution environment supports a remote authentication mechanism, providing trusted proof of the environment's identity and code integrity to external business systems. Data transmission is only initiated after the external system has successfully verified the proof.

[0037] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described herein. Any modifications or substitutions to the present invention, as well as all technical solutions and improvements that do not depart from the spirit and scope of the invention, are covered within the scope of the claims of the present invention.

Claims

1. A computer data anonymization calculation method based on a trusted execution environment, characterized in that, The steps include: Step 1: Create a trusted execution environment instance based on the hardware security module and generate an environment identity key pair. ,in For public keys, The private key is stored within the Trusted Execution Environment (TEE). A secure boot verification mechanism is deployed within the TEE, using the SHA-256 hash algorithm to calculate the digest value of the de-identified code to be loaded. , compared with the preset trusted digest value In contrast, when Time verification passed; initial size is [value missing]. The encrypted memory region, in which This represents the maximum volume of data to be anonymized in a single batch. The size of the desensitization rule set; Step 2: The external business system preprocesses the data to be anonymized, identifies the types of sensitive fields, and marks them with anonymization rule identifiers. ,in Indexing sensitive fields; using Encrypt the data to be de-identified using the RSA-2048 algorithm. Generate ciphertext ,Will The data is concatenated into a transmission data packet and sent to the trusted execution environment via a TLS 1.3 secure channel; Step 3: Trusted Execution Environment (TEX) Decryption Obtain plaintext data Load the desensitization rule set, according to Match the corresponding desensitization rules ； Step 4: Perform desensitization calculation within the encrypted memory area: When using the offset algorithm for structured sensitive fields, calculate the offset amount. ,in To preset the maximum offset threshold, the de-identified field value is For mask-type sensitive fields, retain the first one. Position and after Bit, Replace Length The calculation process uses The algorithm encrypts intermediate data in real time, using the encryption key. The data is dynamically generated by a hardware random number generator within a trusted execution environment; de-identified data is generated after the de-identification process is complete. Calculate its SHA-256 checksum. ； Step 5: Use encryption Later and They are exported together to external business systems, which then recalculate the SHA-256 hash. The summary value, and After verifying the completeness of the comparison, it can be put into business use.

2. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, Hardware security modules include or The initialization latency of any of the following: Trusted Execution Environment instance .

3. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, In step 2, the preprocessing process includes cleaning redundant data and filling in null values. Null value filling uses the field mean. .

4. The computer data anonymization calculation method based on a trusted execution environment according to claim 3, characterized in that, The masking rule set includes at least four standard masking algorithms: masking algorithm, replacement algorithm, offset algorithm, and randomization algorithm. Custom masking rules support matching sensitive fields using regular expressions.

5. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, In step 4, when performing the offset algorithm on the sensitive field of the ID card number, the offset range is... The date of birth field remains valid even after offset, and the validity of the ID card verification code is preserved.

6. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, In step 4, the initial vector of the AES-GCM algorithm The number is 12 bytes long and is generated by a hardware random number generator, ensuring that each de-identification calculation produces a unique result. The intermediate data encryption process satisfies: ； in For intermediate plaintext data, This is the encrypted ciphertext data.

7. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, Desensitization processing latency for single batch of data satisfy: ； in For processing efficiency coefficient, For fixed expenses, 。 8. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, It also includes step 6: The trusted execution environment generates de-identification audit logs, and the log data includes the de-identification initiation time. Data processing volume Success rate of desensitization rule matching ,in The number of sensitive fields that successfully match the rules; audit logs are encrypted and stored using the AES-256 algorithm, with the key derived from the environment identity key pair: ,in For hash-based key derivation functions, This is the preset salt value.

9. The computer data anonymization calculation method based on a trusted execution environment according to claim 1, characterized in that, The secure startup verification mechanism in step 1 uses a hash algorithm to perform integrity verification on the de-identified computation code loaded into the trusted execution environment. If the verification fails, the code execution is terminated and a security alarm is triggered.

10. The computer data desensitization calculation method based on a trusted execution environment according to any one of claims 1 to 9, characterized in that, The Trusted Execution Environment supports a remote authentication mechanism, providing trusted authentication of the environment's identity and code integrity to external business systems. Data transmission is only initiated after the external system has verified the authentication.