@liuhange/dsh-data-masking 2.0.0 → 2.0.1

package/lib/index.js

@@ -1,7 +1,8 @@
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import * as fs from "fs";
 import * as path from "path";
-import { AuditLogger, BusinessRulesLoader, FileFormatAdapter, PathValidator, ReportGenerator } from "@deepseek-ai/dsh-data-asset-shared";
+import { AuditLogger, BusinessRulesLoader, FileFormatAdapter, PathValidator, ReportGenerator } from "@liuhange/dsh-data-asset-shared";
+import * as crypto from "crypto";
 //#region lib/types/sensitiveFieldScanner.js
 var SensitiveFieldScanner = class {
 	scan(lines, sensitivePatterns) {
@@ -50,6 +51,332 @@ var MaskingStrategyExecutor = class {
 	}
 };
 //#endregion
+//#region lib/types/algorithms/fpeAlgorithm.js
+var FpeAlgorithm = class {
+	encrypt(plaintext, key) {
+		if (!key) throw new Error("错误：FPE密钥未配置");
+		const chars = plaintext.split("");
+		const radix = 10;
+		if (!chars.every((c) => /\d/.test(c))) return this.encryptGeneric(plaintext, key);
+		const n = plaintext.length;
+		if (n < 2) return plaintext;
+		const keyHash = crypto.createHash("sha256").update(key).digest();
+		const rounds = 10;
+		const inputNums = chars.map((c) => parseInt(c, 10));
+		for (let round = 0; round < rounds; round++) {
+			const roundKey = crypto.createHash("sha256").update(keyHash).update(Buffer.from([round])).digest();
+			for (let i = 0; i < n - 1; i++) {
+				const mod = radix ** (n - i - 1);
+				const prfInput = Buffer.alloc(4);
+				prfInput.writeUInt32BE(inputNums[i], 0);
+				const prfNum = crypto.createHmac("sha256", roundKey).update(prfInput).digest().readUInt32BE(0) % mod;
+				inputNums[i + 1] = (inputNums[i + 1] + prfNum) % radix;
+			}
+			for (let i = n - 2; i >= 0; i--) {
+				const mod = radix ** (n - i - 1);
+				const prfInput = Buffer.alloc(4);
+				prfInput.writeUInt32BE(inputNums[i + 1], 0);
+				const prfNum = crypto.createHmac("sha256", roundKey).update(prfInput).digest().readUInt32BE(0) % mod;
+				inputNums[i] = (inputNums[i] + prfNum) % radix;
+			}
+		}
+		return inputNums.join("");
+	}
+	decrypt(ciphertext, key) {
+		if (!key) throw new Error("错误：FPE密钥未配置");
+		const chars = ciphertext.split("");
+		const radix = 10;
+		if (!chars.every((c) => /\d/.test(c))) return this.decryptGeneric(ciphertext, key);
+		const n = ciphertext.length;
+		if (n < 2) return ciphertext;
+		const keyHash = crypto.createHash("sha256").update(key).digest();
+		const rounds = 10;
+		const outputNums = chars.map((c) => parseInt(c, 10));
+		for (let round = rounds - 1; round >= 0; round--) {
+			const roundKey = crypto.createHash("sha256").update(keyHash).update(Buffer.from([round])).digest();
+			for (let i = 0; i < n - 1; i++) {
+				const mod = radix ** (n - i - 1);
+				const prfInput = Buffer.alloc(4);
+				prfInput.writeUInt32BE(outputNums[i + 1], 0);
+				const prfNum = crypto.createHmac("sha256", roundKey).update(prfInput).digest().readUInt32BE(0) % mod;
+				outputNums[i] = ((outputNums[i] - prfNum) % radix + radix) % radix;
+			}
+			for (let i = n - 2; i >= 0; i--) {
+				const mod = radix ** (n - i - 1);
+				const prfInput = Buffer.alloc(4);
+				prfInput.writeUInt32BE(outputNums[i], 0);
+				const prfNum = crypto.createHmac("sha256", roundKey).update(prfInput).digest().readUInt32BE(0) % mod;
+				outputNums[i + 1] = ((outputNums[i + 1] - prfNum) % radix + radix) % radix;
+			}
+		}
+		return outputNums.join("");
+	}
+	encryptGeneric(plaintext, key) {
+		const keyHash = crypto.createHash("sha256").update(key).digest();
+		const result = [];
+		for (let i = 0; i < plaintext.length; i++) {
+			const charCode = plaintext.charCodeAt(i);
+			const offset = crypto.createHmac("sha256", keyHash).update(Buffer.from([i & 255])).digest()[0] % 256;
+			result.push(String.fromCharCode((charCode + offset) % 256));
+		}
+		return result.join("");
+	}
+	decryptGeneric(ciphertext, key) {
+		const keyHash = crypto.createHash("sha256").update(key).digest();
+		const result = [];
+		for (let i = 0; i < ciphertext.length; i++) {
+			const charCode = ciphertext.charCodeAt(i);
+			const offset = crypto.createHmac("sha256", keyHash).update(Buffer.from([i & 255])).digest()[0] % 256;
+			result.push(String.fromCharCode((charCode - offset + 256) % 256));
+		}
+		return result.join("");
+	}
+};
+//#endregion
+//#region lib/types/algorithms/kAnonymityAlgorithm.js
+var KAnonymityAlgorithm = class {
+	anonymize(records, kValue, quasiIdentifiers) {
+		if (records.length === 0 || quasiIdentifiers.length === 0) return {
+			anonymizedRecords: records,
+			actualMinEquivalenceClass: 0,
+			suppressedCount: 0
+		};
+		let workingRecords = [...records];
+		let generalized = true;
+		let generalizationLevel = 0;
+		while (generalized) {
+			generalized = false;
+			const groups = this.groupByQuasiIdentifiers(workingRecords, quasiIdentifiers);
+			if (Math.min(...groups.map((g) => g.length)) >= kValue) {
+				const minClass = Math.min(...groups.map((g) => g.length));
+				return {
+					anonymizedRecords: workingRecords,
+					actualMinEquivalenceClass: minClass,
+					suppressedCount: 0
+				};
+			}
+			if (generalizationLevel < 3) {
+				workingRecords = this.generalize(workingRecords, quasiIdentifiers, generalizationLevel);
+				generalizationLevel++;
+				generalized = true;
+			}
+		}
+		const groups = this.groupByQuasiIdentifiers(workingRecords, quasiIdentifiers);
+		const validGroups = groups.filter((g) => g.length >= kValue);
+		const suppressedRecords = groups.filter((g) => g.length < kValue).flat();
+		const anonymizedRecords = validGroups.flat();
+		const allGroups = [...validGroups, ...groups.filter((g) => g.length < kValue)];
+		return {
+			anonymizedRecords,
+			actualMinEquivalenceClass: allGroups.length > 0 ? Math.min(...allGroups.map((g) => g.length)) : 0,
+			suppressedCount: suppressedRecords.length
+		};
+	}
+	groupByQuasiIdentifiers(records, quasiIdentifiers) {
+		const groups = /* @__PURE__ */ new Map();
+		for (const record of records) {
+			const key = quasiIdentifiers.map((qi) => String(record[qi] ?? "")).join("|");
+			const group = groups.get(key);
+			if (group) group.push(record);
+			else groups.set(key, [record]);
+		}
+		return Array.from(groups.values());
+	}
+	generalize(records, quasiIdentifiers, level) {
+		return records.map((record) => {
+			const generalized = { ...record };
+			for (const qi of quasiIdentifiers) {
+				const value = String(generalized[qi] ?? "");
+				if (value.length > level + 1) generalized[qi] = value.substring(0, value.length - level - 1) + "*".repeat(level + 1);
+				else generalized[qi] = "*".repeat(value.length);
+			}
+			return generalized;
+		});
+	}
+};
+//#endregion
+//#region lib/types/algorithms/differentialPrivacyAlgorithm.js
+var DifferentialPrivacyAlgorithm = class {
+	addNoise(trueValue, epsilon, sensitivity, budgetTracker, totalBudget) {
+		if (!budgetTracker.canConsume(epsilon, totalBudget)) throw new Error("隐私预算已耗尽，拒绝查询");
+		const scale = sensitivity / epsilon;
+		const noise = this.generateLaplaceNoise(scale);
+		budgetTracker.consume(epsilon);
+		return trueValue + noise;
+	}
+	generateLaplaceNoise(scale) {
+		const adjustedU = this.generateSecureUniform() - .5;
+		return -scale * Math.sign(adjustedU) * Math.log(1 - 2 * Math.abs(adjustedU));
+	}
+	generateSecureUniform() {
+		const uint64 = crypto.randomBytes(8).readBigUInt64BE(0);
+		const maxUint64 = BigInt(2) ** BigInt(64) - BigInt(1);
+		return Number(uint64) / Number(maxUint64);
+	}
+};
+//#endregion
+//#region lib/types/algorithms/hashAlgorithm.js
+var HashAlgorithm = class {
+	hash(plaintext, hashAlgorithm, salt) {
+		const input = salt ? salt + plaintext : plaintext;
+		const algorithm = hashAlgorithm === "SHA-512" ? "SHA-512" : "SHA-256";
+		const hash = crypto.createHash(algorithm);
+		hash.update(input, "utf-8");
+		const digest = hash.digest("hex");
+		return {
+			digest,
+			salted: salt !== void 0 && salt !== "",
+			digestLength: digest.length
+		};
+	}
+};
+//#endregion
+//#region lib/types/budgetTracker.js
+var BudgetTracker = class {
+	consumed = 0;
+	queryCount = 0;
+	totalBudget;
+	constructor(totalBudget) {
+		this.totalBudget = totalBudget;
+	}
+	consume(epsilon) {
+		this.consumed += epsilon;
+		this.queryCount++;
+	}
+	canConsume(epsilon, totalBudget) {
+		return this.consumed + epsilon <= totalBudget;
+	}
+	getState() {
+		return {
+			totalBudget: this.totalBudget,
+			consumed: this.consumed,
+			remaining: this.totalBudget - this.consumed,
+			queryCount: this.queryCount
+		};
+	}
+};
+//#endregion
+//#region lib/types/advancedMaskingExecutor.js
+var AdvancedMaskingExecutor = class {
+	fpeAlgorithm = new FpeAlgorithm();
+	kAnonymityAlgorithm = new KAnonymityAlgorithm();
+	differentialPrivacyAlgorithm = new DifferentialPrivacyAlgorithm();
+	hashAlgorithm = new HashAlgorithm();
+	execute(data, algorithm, fieldName, config) {
+		switch ((fieldName ? config.fieldAlgorithms[fieldName] : void 0)?.algorithm ?? algorithm) {
+			case "FPE": return this.executeFpe(data, config);
+			case "k-anonymity": return this.executeKAnonymity(data, config);
+			case "differential-privacy": return this.executeDifferentialPrivacy(data, config);
+			case "hash": return this.executeHash(data, config);
+			default: return this.executeHash(data, config);
+		}
+	}
+	executeFpe(data, config) {
+		const key = this.resolveEnvVar(config.fpe.key);
+		return {
+			maskedData: this.fpeAlgorithm.encrypt(data, key),
+			algorithm: "FPE",
+			details: {
+				algorithm: "FPE",
+				reversible: true
+			}
+		};
+	}
+	executeKAnonymity(data, config) {
+		const kValue = config.kAnonymity.kValue;
+		const quasiIdentifiers = config.kAnonymity.quasiIdentifiers;
+		let records;
+		try {
+			records = JSON.parse(data);
+		} catch {
+			records = [{ value: data }];
+		}
+		const result = this.kAnonymityAlgorithm.anonymize(records, kValue, quasiIdentifiers);
+		const details = {
+			algorithm: "k-anonymity",
+			kValue,
+			actualMinEquivalenceClass: result.actualMinEquivalenceClass,
+			suppressedCount: result.suppressedCount
+		};
+		return {
+			maskedData: JSON.stringify(result.anonymizedRecords),
+			algorithm: "k-anonymity",
+			details
+		};
+	}
+	executeDifferentialPrivacy(data, config) {
+		const epsilon = config.differentialPrivacy.epsilon;
+		const totalBudget = config.differentialPrivacy.totalBudget;
+		const sensitivity = config.differentialPrivacy.sensitivity;
+		const budgetTracker = new BudgetTracker(totalBudget);
+		const trueValue = Number(data);
+		if (isNaN(trueValue)) throw new Error("差分隐私要求输入为数字");
+		const noisyValue = this.differentialPrivacyAlgorithm.addNoise(trueValue, epsilon, sensitivity, budgetTracker, totalBudget);
+		const budgetState = budgetTracker.getState();
+		const details = {
+			algorithm: "differential-privacy",
+			epsilon,
+			budgetConsumed: budgetState.consumed,
+			budgetRemaining: budgetState.remaining
+		};
+		return {
+			maskedData: String(noisyValue),
+			algorithm: "differential-privacy",
+			details
+		};
+	}
+	executeHash(data, config) {
+		const hashAlgo = config.hash.algorithm;
+		const salt = this.resolveEnvVar(config.hash.salt);
+		const result = this.hashAlgorithm.hash(data, hashAlgo, salt || void 0);
+		const details = {
+			algorithm: "hash",
+			hashAlgorithm: hashAlgo,
+			salted: result.salted,
+			digestLength: result.digestLength
+		};
+		return {
+			maskedData: result.digest,
+			algorithm: "hash",
+			details
+		};
+	}
+	resolveEnvVar(value) {
+		if (value.startsWith("${") && value.endsWith("}")) {
+			const envVar = value.slice(2, -1);
+			return process.env[envVar] ?? "";
+		}
+		return value;
+	}
+};
+//#endregion
+//#region lib/types/defaultAdvancedMaskingConfig.js
+const defaultAdvancedMaskingConfig = {
+	defaultAlgorithm: "hash",
+	fieldAlgorithms: {},
+	fpe: {
+		key: "",
+		radix: 10
+	},
+	kAnonymity: {
+		kValue: 2,
+		quasiIdentifiers: [
+			"zipCode",
+			"age",
+			"gender"
+		]
+	},
+	differentialPrivacy: {
+		epsilon: 1,
+		totalBudget: 5,
+		sensitivity: 1
+	},
+	hash: {
+		algorithm: "SHA-256",
+		salt: ""
+	}
+};
+//#endregion
 //#region lib/types/index.js
 const name = "data-masking";
 const inject = ["tools"];
@@ -61,9 +388,10 @@ function apply(ctx) {
 	const auditLogger = new AuditLogger();
 	const scanner = new SensitiveFieldScanner();
 	const strategyExecutor = new MaskingStrategyExecutor();
+	const advancedExecutor = new AdvancedMaskingExecutor();
 	ctx.tools.register(defineTool({
 		name: "mask_sensitive_data",
-		description: "识别并脱敏数据中的敏感字段（身份证、手机号、银行卡、邮箱）",
+		description: "识别并脱敏数据中的敏感字段（身份证、手机号、银行卡、邮箱），支持高级算法（FPE/k-匿名/差分隐私/哈希）",
 		parameters: {
 			filePath: {
 				type: "string",
@@ -73,6 +401,14 @@ function apply(ctx) {
 			strategy: {
 				type: "string",
 				description: "脱敏策略: FULL | PARTIAL | GENERALIZE"
+			},
+			algorithm: {
+				type: "string",
+				description: "高级脱敏算法: FPE | k-anonymity | differential-privacy | hash"
+			},
+			fieldName: {
+				type: "string",
+				description: "字段名（用于字段级算法配置覆盖）"
 			}
 		},
 		output: {
@@ -87,6 +423,8 @@ function apply(ctx) {
 			const workingDir = process.cwd();
 			const filePath = args.filePath;
 			const strategy = args.strategy ?? "PARTIAL";
+			const algorithm = args.algorithm;
+			const fieldName = args.fieldName;
 			try {
 				pathValidator.validate(filePath, workingDir);
 			} catch {
@@ -94,6 +432,28 @@ function apply(ctx) {
 			}
 			const fullPath = path.resolve(filePath);
 			if (!fs.existsSync(fullPath)) return `错误：文件不存在 - ${fullPath}`;
+			if (algorithm) {
+				const advancedConfig = config.advancedMasking ?? defaultAdvancedMaskingConfig;
+				const readResult = await formatAdapter.read(fullPath);
+				const lines = readResult.lines;
+				const maskedLines = [];
+				for (const line of lines) {
+					const result = advancedExecutor.execute(line, algorithm, fieldName, advancedConfig);
+					maskedLines.push(typeof result.maskedData === "string" ? result.maskedData : JSON.stringify(result.maskedData));
+				}
+				const ext = path.extname(fullPath);
+				const baseName = path.basename(fullPath, ext);
+				const outputPath = path.join(path.dirname(fullPath), `${baseName}_masked${ext}`);
+				await formatAdapter.write(outputPath, maskedLines, readResult.format);
+				auditLogger.log({
+					pluginName: "data-masking",
+					operation: "mask_sensitive_data",
+					inputPath: fullPath,
+					outputPath,
+					result: "SUCCESS"
+				});
+				return `高级脱敏完成（算法: ${algorithm}）\n输入: ${fullPath}\n输出: ${outputPath}\n处理行数: ${maskedLines.length}`;
+			}
 			const readResult = await formatAdapter.read(fullPath);
 			const lines = readResult.lines;
 			const scanResult = scanner.scan(lines, config.sensitivePatterns);

package/package.json

@@ -1,7 +1,7 @@
-{
+{
     "name":  "@liuhange/dsh-data-masking",
     "description":  "Data masking plugin: sensitive field identification and graded masking (FULL/PARTIAL/GENERALIZE)",
-    "version":  "2.0.0",
+    "version": "2.0.1",
     "publishConfig":  {
                           "access":  "public"
                       },