Sensitive data processing method and device, equipment and storage medium

Abstract

The invention relates to the technical field of sensitive data processing, and discloses a sensitive data processing method, device and equipment and a storage medium. A structural sensitive data set stored in a sensitive data server and sensitive data calling demand information of a data calling terminal in a target calling period are obtained; in consideration of storage space limitation and fuzzy decryption efficiency of a sensitive data server, the sensitive data server is driven to construct a sensitive data fuzzy encryption list and a fuzzy decryption key corresponding to each data calling terminal in a target calling period based on sensitive data non-full element encryption and dynamic key management principles; the sensitive data element fuzzy encryption and fuzzy decryption processing based on the structural sensitive data difference under the service operation system is realized, and the server processing load and the data calling delay are reduced while the sensitive data fuzzy processing fine granularity and the data calling adaptability are improved; and the sensitive data security and availability requirements of the service operation system are balanced.

Description

Technical Field

[0001] This invention relates to the field of sensitive data processing technology, and in particular to a sensitive data processing method, apparatus, device, and storage medium. Background Technology

[0002] Sensitive data refers to a set of data that, if leaked, tampered with, or misused, could cause substantial harm to individual rights, corporate interests, or the public interest. In business operation systems (such as e-commerce platforms, core financial systems, and medical information systems), performing fuzzy encryption on sensitive data (i.e., using partial masking, format conversion, or encryption algorithms to protect sensitive information, restricting unauthorized access while preserving data availability) is a core aspect of ensuring system security and business sustainability.

[0003] In practical applications, several pieces of structured sensitive data with the same data composition stored in the business operation system often contain sensitive data elements with different attributes at different data structure locations. The needs and sources for accessing data with different attributes differ (for example, for the same piece of structured sensitive data, employees in department A are only authorized to see the 1st / 3rd / 5th sensitive data elements, while the 2nd / 4th / 6th sensitive data elements need to be obfuscated; while employees in department B are only authorized to see the 2nd / 3rd sensitive data elements, while the 1st / 4th / 5th / 6th sensitive data elements need to be obfuscated, and so on). This results in different sensitive data access requirements from different data access terminals during different business task requests. Furthermore, to ensure the security of the obfuscated encryption of sensitive data, decryption after obfuscation usually employs symmetric encryption algorithms. Although not overly complex algorithms are needed, performing full obfuscation encryption on the entire structured sensitive dataset in the sensitive data server would impose a significant computational burden and delay in sensitive data access on the system. In addition, to ensure the security of sensitive data access, the keys used for fuzzy encryption and decryption usually need to be changed with each request rather than using a fixed key. These factors make the fuzzy encryption of sensitive data in the business operation system quite difficult.

[0004] Therefore, how to achieve fuzzy encryption and decryption of sensitive data elements based on the differences in structured sensitive data in the business operation system, while improving the fine-grainedness of sensitive data fuzzy processing and data call adaptability, reducing server processing load and data call latency, and balancing the needs of sensitive data security and availability in the business operation system, is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] The present invention provides a sensitive data processing method, apparatus, device and storage medium, which aims to solve at least one of the above-mentioned technical problems.

[0006] To achieve the above objectives, the present invention provides a sensitive data processing method, the method comprising the following steps: Obtain a structured sensitive dataset stored in a sensitive data server; wherein, several structured sensitive data entries in the structured sensitive dataset are configured to have the same data composition structure, and each structured sensitive data entry includes several sensitive data elements corresponding to different data structure positions; Receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy is generated; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; The structured sensitive data fuzzy encryption sub-strategy is sent to the sensitive data server, which then generates several structured fuzzy encrypted sensitive datasets before the target call cycle, thus constructing a sensitive data fuzzy encryption list. The data is sent to the sensitive data server via a fuzzy decryption generation sub-strategy, which in turn sends the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data call terminal. Fuzzy decryption is then performed using the fuzzy decryption key.

[0007] Optionally, the steps for obtaining structured sensitive datasets stored on the sensitive data server include: Access the business operation database; wherein, the business operation database stores several business operation data with the same data composition structure, and each business operation data includes several data elements corresponding to different data structure positions; Based on the sensitive data determination criteria, a structured sensitive dataset is formed by extracting several pieces of structured sensitive data that meet the sensitive data determination criteria from the business operation database.

[0008] Optionally, the step of extracting several pieces of structured sensitive data that meet the sensitive data determination criteria from the business operation database includes: The system obtains the current sensitive data judgment conditions pre-entered by the data management terminal and extracts several data element judgment factors from the sensitive data judgment conditions; wherein, the sensitive data judgment conditions include judgment items for at least one data element judgment factor; Based on the judgment item for at least one data element judgment factor, the business operation data containing several data elements is filtered and judged, and structure-sensitive data is selected from several business operation data in the business operation database.

[0009] Optionally, the step of receiving sensitive data access requests uploaded by several data access terminals and generating sensitive data access requirement information for the target access period based on the sensitive data access requests specifically includes: Receive sensitive data access requests uploaded by several data access terminals, and extract the sensitive data element access type and sensitive data element access time period from each sensitive data access request; The sensitive data call requests that meet the target call cycle during the time period of the sensitive data element call are extracted and summarized to generate sensitive data call requirement information for the target call cycle.

[0010] Optionally, based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy step is generated, specifically including: Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, the storage space of the sensitive data server for sensitive data storage and call and the decryption time of the target fuzzy decryption algorithm for different decryption time periods are considered. The solution objective is to select sensitive data elements at different data structure locations in the structured sensitive dataset as fuzzy encryption elements and convert them to generate a structured fuzzy encrypted sensitive dataset. The number of generated structured fuzzy encrypted sensitive datasets and the allocation of each sensitive data access request to the structured fuzzy encrypted sensitive dataset are defined as the solution objective. The first constraint is that the total space occupied by the structured fuzzy encrypted sensitive dataset, determined by the number of generated datasets and the size of a single dataset, must be less than the storage space required by the sensitive data server for sensitive data storage and access. The second constraint is that each sensitive data element allocated to the structured fuzzy encrypted sensitive dataset in each time period... The second constraint is that the sensitive data element in the call request is included in the time period of the action, and other sensitive data elements other than the sensitive data element call type of each sensitive data call request are configured as fuzzy encryption elements. The optimization objective is to maximize the fuzzy decryption efficiency determined by the number of sensitive data elements in each sensitive data call request of the structured fuzzy encryption sensitive dataset allocated to each time period, the number of elements that need to be fuzzy decrypted, the decryption time of the sensitive data element call period and the decryption time of different decryption periods for the target fuzzy decryption algorithm. The optimization algorithm is used to solve the structured sensitive data fuzzy encryption sub-strategy and the data call fuzzy decryption generation sub-strategy. The sub-strategy for fuzzy encryption of structured sensitive data includes: selecting sensitive data elements at different data structure positions in the structured sensitive dataset as fuzzy encryption elements and converting them into the structured fuzzy encrypted sensitive dataset and the number of conversions of the structured fuzzy encrypted sensitive dataset; The data retrieval fuzzy decryption generation sub-strategy includes: the structured fuzzy encrypted sensitive data assigned to each sensitive data retrieval request.

[0011] Optionally, the step of sending the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, causing the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and constructing a sensitive data fuzzy encryption list, specifically includes: The structured sensitive data fuzzy encryption sub-strategy is sent to the sensitive data server, which is then driven to perform fuzzy encryption before the target call cycle, generating several structured fuzzy encrypted sensitive datasets and constructing a sensitive data fuzzy encryption list. The fuzzy encryption action is configured to generate a corresponding number of structured fuzzy encrypted sensitive datasets based on the structured sensitive data fuzzy encryption sub-strategy, and the sensitive data elements whose corresponding data structure positions are selected as fuzzy encryption elements in each structured fuzzy encrypted sensitive dataset are fuzzy encrypted using the target fuzzy encryption algorithm.

[0012] Optionally, the data is invoked to generate a fuzzy decryption sub-strategy and sent to a sensitive data server, causing the sensitive data server to send the fuzzy decryption key and the index position of the allocated structured fuzzy encrypted sensitive dataset to the corresponding data invocation terminal. The fuzzy decryption step is then performed using the fuzzy decryption key, specifically including: The data is invoked to generate a fuzzy decryption sub-strategy and sent to the sensitive data server, which then drives the sensitive data server to generate a structured fuzzy encrypted sensitive dataset allocated in the sensitive data fuzzy encryption list for each data invocation terminal and a fuzzy decryption key corresponding to the target fuzzy encryption algorithm. The fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset in the sensitive data fuzzy encryption list are sent to the corresponding data calling terminal, which then uses the fuzzy decryption key to perform fuzzy decryption.

[0013] Furthermore, to achieve the above objectives, the present invention also provides a sensitive data processing apparatus, comprising: The acquisition module is used to acquire a structured sensitive dataset stored in a sensitive data server; wherein, several pieces of structured sensitive data in the structured sensitive dataset are configured to have the same data composition structure, and each piece of structured sensitive data includes several sensitive data elements corresponding to different data structure positions; The receiving module is used to receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; The generation module is used to generate a sensitive data processing strategy based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, taking into account the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; The module is used to send the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, and drive the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and construct a sensitive data fuzzy encryption list. The execution module is used to send the data to the fuzzy decryption generation sub-strategy to the sensitive data server, and to drive the sensitive data server to send the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data call terminal, and to perform fuzzy decryption using the fuzzy decryption key.

[0014] In addition, to achieve the above objectives, the present invention also provides a sensitive data processing device, the sensitive data processing device comprising: a memory, a processor, and a sensitive data processing program stored in the memory and executable on the processor, wherein the sensitive data processing program, when executed by the processor, implements the steps of the sensitive data processing method as described above.

[0015] In addition, to achieve the above objectives, the present invention also provides a storage medium storing a sensitive data processing program, which, when executed by a processor, implements the steps of the above-described sensitive data processing method.

[0016] The beneficial effects of this invention are as follows: It proposes a sensitive data processing method, apparatus, device, and storage medium. By acquiring a structured sensitive dataset stored in a sensitive data server, and based on the sensitive data element call types and call periods in the sensitive data call request information of several data call terminals in the target call period, considering the storage space limitations and fuzzy decryption efficiency of the sensitive data server, and taking the principle of non-full element encryption and dynamic key management of sensitive data, a sensitive data processing strategy is solved. This drives the sensitive data server to construct a sensitive data fuzzy encryption list and a fuzzy decryption key corresponding to each data call terminal in the target call period. This enables fuzzy encryption and fuzzy decryption processing of sensitive data elements based on the differences in structured sensitive data in the business operation system. While improving the fine-grainedness of sensitive data fuzzy processing and data call adaptability, it reduces the server processing load and data call latency, balancing the needs of sensitive data security and availability in the business operation system. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention; Figure 2 This is a flowchart illustrating an embodiment of the sensitive data processing method of the present invention; Figure 3 This is a structural block diagram of a sensitive data processing device according to an embodiment of the present invention. Detailed Implementation

[0018] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0020] like Figure 1 As shown, Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention.

[0021] like Figure 1 As shown, the device may include: a processor 1001, such as a CPU; a communication bus 1002; a user interface 1003; a network interface 1004; and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0022] Those skilled in the art will understand that Figure 1 The structure of the device shown does not constitute a limitation on the device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0023] like Figure 1 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a sensitive data processing program.

[0024] exist Figure 1 In the terminal shown, network interface 1004 is mainly used to connect to the backend server and communicate with it; user interface 1003 is mainly used to connect to the client (user terminal) and communicate with it; while processor 1001 can be used to call the sensitive data processing program stored in memory 1005 and perform the following operations: Obtain a structured sensitive dataset stored in a sensitive data server; wherein, several structured sensitive data entries in the structured sensitive dataset are configured to have the same data composition structure, and each structured sensitive data entry includes several sensitive data elements corresponding to different data structure positions; Receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy is generated; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; The structured sensitive data fuzzy encryption sub-strategy is sent to the sensitive data server, which then generates several structured fuzzy encrypted sensitive datasets before the target call cycle, thus constructing a sensitive data fuzzy encryption list. The data is sent to the sensitive data server via a fuzzy decryption generation sub-strategy, which in turn sends the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data call terminal. Fuzzy decryption is then performed using the fuzzy decryption key.

[0025] The specific embodiments of the present invention applied to the device are basically the same as the embodiments of the application of sensitive data processing methods described below, and will not be repeated here.

[0026] This invention provides a sensitive data processing method, referring to... Figure 2 , Figure 2 This is a flowchart illustrating an embodiment of the sensitive data processing method of the present invention.

[0027] In this embodiment, a sensitive data processing method includes the following steps: S100: Obtain the structured sensitive dataset stored in the sensitive data server; wherein, several pieces of structured sensitive data in the structured sensitive dataset are configured to have the same data composition structure, and each piece of structured sensitive data includes several sensitive data elements corresponding to different data structure positions; S200: Receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; S300: Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy is generated; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; S400: Send the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, causing the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and construct a sensitive data fuzzy encryption list. S500: The data is invoked to generate a fuzzy decryption sub-strategy and sent to the sensitive data server, which then sends the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data invocation terminal, and performs fuzzy decryption using the fuzzy decryption key.

[0028] It should be noted that in practical applications, several pieces of structured sensitive data with the same data composition stored in the business operation system often contain sensitive data elements with different attributes at different data structure locations. The needs and sources for accessing data with different attributes are different (for example, for the same piece of structured sensitive data, employees in department A are only authorized to see the 1st / 3rd / 5th sensitive data elements, while the 2nd / 4th / 6th sensitive data elements need to be obfuscated; while employees in department B are only authorized to see the 2nd / 3rd sensitive data elements, while the 1st / 4th / 5th / 6th sensitive data elements need to be obfuscated, and so on). This results in different sensitive data access requirements from different data access terminals when requesting different business tasks. Furthermore, to ensure the security of the obfuscated encryption of sensitive data, decryption after obfuscation usually employs some symmetric encryption algorithms. Although not overly complex algorithms are needed, performing full obfuscation encryption on the entire structured sensitive dataset in the sensitive data server would impose a significant computational burden and delay in sensitive data access on the system. In addition, to ensure the security of sensitive data access, the keys used for fuzzy encryption and decryption usually need to be changed with each request rather than using a fixed key. These factors make the fuzzy encryption of sensitive data in the business operation system quite difficult.

[0029] To address the aforementioned issues, this embodiment obtains the structured sensitive dataset stored in the sensitive data server and the sensitive data retrieval request information of the data retrieval terminal during the target retrieval period. Considering the storage space limitations and fuzzy decryption efficiency of the sensitive data server, and based on the principles of non-full element encryption and dynamic key management of sensitive data, it drives the sensitive data server to construct a fuzzy encryption list of sensitive data and a fuzzy decryption key corresponding to each data retrieval terminal during the target retrieval period. This enables fuzzy encryption and fuzzy decryption processing of sensitive data elements based on the differences in structured sensitive data within the business operation system. While improving the granularity of sensitive data fuzzy processing and data retrieval adaptability, it reduces server processing load and data retrieval latency, balancing the needs of sensitive data security and availability in the business operation system.

[0030] In a preferred embodiment, the step of obtaining the structured sensitive dataset stored in the sensitive data server specifically includes: S110: Access the business operation database; wherein, the business operation database stores several business operation data with the same data composition structure, and each business operation data includes several data elements corresponding to different data structure positions; S120: Based on the sensitive data determination criteria, extract a structured sensitive dataset consisting of several structured sensitive data that meet the sensitive data determination criteria from the business operation database.

[0031] Based on this, the steps for extracting several pieces of structured sensitive data that meet the sensitive data determination criteria from the business operation database include: S121: Obtain the current sensitive data judgment conditions pre-entered by the data management terminal, and extract several data element judgment factors from the sensitive data judgment conditions; wherein, the sensitive data judgment conditions include judgment items for at least one data element judgment factor; S122: Based on the judgment item for at least one data element judgment factor, the business operation data containing several data elements is screened and judged, and structured sensitive data is selected from several business operation data in the business operation database.

[0032] In this embodiment, by accessing the business operation database and extracting several pieces of structured sensitive data that meet the criteria including a criterion for at least one data element, based on the sensitive data judgment conditions pre-entered in the data management terminal, a customized structured sensitive dataset can be dynamically generated according to business needs, based on the business operation database and the sensitive data judgment conditions.

[0033] In a preferred embodiment, the step of receiving sensitive data access requests uploaded by several data access terminals and generating sensitive data access requirement information for a target access period based on the sensitive data access requests specifically includes: S210: Receive sensitive data access requests uploaded by several data access terminals, and extract the sensitive data element access type and sensitive data element access time period from each sensitive data access request; S220: Extract and summarize the sensitive data call requests that meet the target call cycle during the sensitive data element call period to generate sensitive data call requirement information for the target call cycle.

[0034] In this embodiment, by analyzing the sensitive data element call type and sensitive data element call time period in the sensitive data call request uploaded by the data call terminal, the sensitive data call requirement information for the target call period is constructed using the sensitive data element call time period.

[0035] In a preferred embodiment, based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy step is generated, specifically including: S310: Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, consider the storage space of the sensitive data server for sensitive data storage and call and the decryption time of the target fuzzy decryption algorithm for different decryption time periods; S320: Sensitive data elements at different data structure locations in the structured sensitive dataset are selected as fuzzy encryption elements and transformed to generate a structured fuzzy encrypted sensitive dataset. The number of generated structured fuzzy encrypted sensitive datasets and the allocation of each sensitive data call request to the structured fuzzy encrypted sensitive dataset are defined as the solution objective. The first constraint is that the total space occupied by the structured fuzzy encrypted sensitive dataset, determined by the number of generated structured fuzzy encrypted sensitive datasets and the size of a single structured fuzzy encrypted sensitive dataset, is less than the storage space required by the sensitive data server for sensitive data storage and call. The allocation of each sensitive data element to the structured fuzzy encrypted sensitive dataset in each time period is defined as follows: The second constraint is that the sensitive data element call time segment of the data call request is included in the effective time segment, and other sensitive data elements other than the sensitive data element call type of each sensitive data call request are configured as fuzzy encryption elements. The optimization objective is to maximize the fuzzy decryption efficiency determined by the number of sensitive data elements call types of each sensitive data call request in the structured fuzzy encryption sensitive dataset allocated in each effective time segment and the number of elements that need to be fuzzy decrypted, the decryption time of the sensitive data element call time segment and the decryption time of the target fuzzy decryption algorithm in different decryption time segments. The optimization algorithm is used to solve the structured sensitive data fuzzy encryption sub-strategy and the data call fuzzy decryption generation sub-strategy. The sub-strategy for fuzzy encryption of structured sensitive data includes: selecting sensitive data elements at different data structure positions in the structured sensitive dataset as fuzzy encryption elements and converting them into the structured fuzzy encrypted sensitive dataset and the number of conversions of the structured fuzzy encrypted sensitive dataset; The data retrieval fuzzy decryption generation sub-strategy includes: the structured fuzzy encrypted sensitive data assigned to each sensitive data retrieval request.

[0036] In this embodiment, considering the storage space limitations and fuzzy decryption efficiency of the sensitive data server, and based on the principles of non-full element encryption and dynamic key management of sensitive data, the first constraint is that the total space occupied by the generated structured fuzzy encrypted sensitive dataset meets the storage space limit. The second constraint is that sensitive data elements are fuzzy encrypted when they are entered into the period of the structured fuzzy encrypted sensitive dataset and when no one at each data calling terminal requests to view them. The optimization objective is to maximize the fuzzy decryption efficiency (which can be measured by minimizing the time taken to decrypt all fuzzy encrypted elements in this embodiment) determined by the number of sensitive data elements requested by the personnel at each data calling terminal that are configured as fuzzy encrypted elements and require fuzzy decryption. The sensitive data processing strategy is then solved to drive the sensitive data server to construct a sensitive data fuzzy encryption list and a fuzzy decryption key corresponding to each data calling terminal in the target calling cycle.

[0037] In a preferred embodiment, the step of sending the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, causing the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and constructing a sensitive data fuzzy encryption list, specifically includes: S410: Send the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, drive the sensitive data server to perform fuzzy encryption before the target call cycle, generate several structured fuzzy encrypted sensitive datasets, and construct a sensitive data fuzzy encryption list. The fuzzy encryption action is configured to generate a corresponding number of structured fuzzy encrypted sensitive datasets based on the structured sensitive data fuzzy encryption sub-strategy, and the sensitive data elements whose corresponding data structure positions are selected as fuzzy encryption elements in each structured fuzzy encrypted sensitive dataset are fuzzy encrypted using the target fuzzy encryption algorithm.

[0038] Based on this, the data fuzzy decryption generation sub-strategy is sent to the sensitive data server, which then sends the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data retrieval terminal. The fuzzy decryption steps are then performed using the fuzzy decryption key, specifically including: S510: Send the data call fuzzy decryption generation sub-strategy to the sensitive data server, and drive the sensitive data server to generate a structured fuzzy encrypted sensitive dataset allocated in the sensitive data fuzzy encryption list for each data call terminal and a fuzzy decryption key corresponding to the target fuzzy encryption algorithm. S520: The fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset in the sensitive data fuzzy encryption list are sent to the corresponding data calling terminal, causing the data calling terminal to perform fuzzy decryption using the fuzzy decryption key.

[0039] In this embodiment, by driving the sensitive data server to construct a fuzzy encryption list of sensitive data and a fuzzy decryption key corresponding to each data calling terminal in the target calling cycle, the fuzzy encryption and fuzzy decryption processing of sensitive data elements based on the differences of structured sensitive data is realized in the business operation system. While improving the fine-grainedness of sensitive data fuzzy processing and the adaptability of data calling, the server processing load and data calling latency are reduced, balancing the needs of sensitive data security and availability in the business operation system.

[0040] Reference Figure 3 , Figure 3 This is a structural block diagram of an embodiment of the sensitive data processing device of the present invention.

[0041] like Figure 3 As shown, the sensitive data processing apparatus proposed in this embodiment of the invention includes: The acquisition module 10 is used to acquire a structured sensitive dataset stored in a sensitive data server; wherein, several pieces of structured sensitive data in the structured sensitive dataset are configured to have the same data composition structure, and each piece of structured sensitive data includes several sensitive data elements corresponding to different data structure positions; The receiving module 20 is used to receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests. The generation module 30 is used to generate a sensitive data processing strategy based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, taking into account the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; Module 40 is used to send the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, and drive the sensitive data server to generate several structured fuzzy encryption sensitive datasets before the target call cycle, and construct a sensitive data fuzzy encryption list. The execution module 50 is used to send the data to the fuzzy decryption generation sub-strategy to the sensitive data server, and to drive the sensitive data server to send the fuzzy decryption key and the index position of the allocated structured fuzzy encrypted sensitive dataset to the corresponding data calling terminal, and to perform fuzzy decryption using the fuzzy decryption key.

[0042] Other embodiments or specific implementations of the sensitive data processing device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0043] Furthermore, the present invention also proposes a sensitive data processing device, which includes: a memory, a processor, and a sensitive data processing program stored in the memory and executable on the processor. When the sensitive data processing program is executed by the processor, it implements the steps of the sensitive data processing method described above.

[0044] The specific implementation of the sensitive data processing device in this application is basically the same as the embodiments of the above-described sensitive data processing methods, and will not be repeated here.

[0045] Furthermore, this invention also proposes a readable storage medium, which includes a computer-readable storage medium storing a sensitive data processing program thereon. The readable storage medium may be... Figure 1 The memory 1005 in the terminal may also be at least one of ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk, etc. The readable storage medium includes a number of instructions to cause a sensitive data processing device with a processor to execute the sensitive data processing methods described in the various embodiments of the present invention.

[0046] The specific implementation methods in the readable storage medium of this application are basically the same as those in the embodiments of the above-described sensitive data processing methods, and will not be described again here.

[0047] It is understood that in the description of this specification, references to terms such as "one embodiment," "another embodiment," "other embodiments," or "first embodiment to Nth embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0048] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0049] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0050] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0051] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for processing sensitive data, characterized in that, The method includes the following steps: Obtain a structured sensitive dataset stored in a sensitive data server; wherein, several structured sensitive data entries in the structured sensitive dataset are configured to have the same data composition structure, and each structured sensitive data entry includes several sensitive data elements corresponding to different data structure positions; Receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy is generated; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; The structured sensitive data fuzzy encryption sub-strategy is sent to the sensitive data server, which then generates several structured fuzzy encrypted sensitive datasets before the target call cycle, thus constructing a sensitive data fuzzy encryption list. The data is sent to the sensitive data server via a fuzzy decryption generation sub-strategy, which in turn sends the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data call terminal. Fuzzy decryption is then performed using the fuzzy decryption key.

2. The sensitive data processing method as described in claim 1, characterized in that, The steps to obtain a structured sensitive dataset stored on a sensitive data server include: Access the business operation database; wherein, the business operation database stores several business operation data with the same data composition structure, and each business operation data includes several data elements corresponding to different data structure positions; Based on the sensitive data determination criteria, a structured sensitive dataset is formed by extracting several pieces of structured sensitive data that meet the sensitive data determination criteria from the business operation database.

3. The sensitive data processing method as described in claim 2, characterized in that, Based on the sensitive data determination criteria, the steps for extracting several pieces of structured sensitive data that meet the sensitive data determination criteria from the business operation database specifically include: The system obtains the current sensitive data judgment conditions pre-entered by the data management terminal and extracts several data element judgment factors from the sensitive data judgment conditions; wherein, the sensitive data judgment conditions include judgment items for at least one data element judgment factor; Based on the judgment item for at least one data element judgment factor, the business operation data containing several data elements is filtered and judged, and structure-sensitive data is selected from several business operation data in the business operation database.

4. The sensitive data processing method as described in claim 1, characterized in that, The steps of receiving sensitive data access requests uploaded by several data access terminals and generating sensitive data access requirement information for a target access period based on the sensitive data access requests specifically include: Receive sensitive data access requests uploaded by several data access terminals, and extract the sensitive data element access type and sensitive data element access time period from each sensitive data access request; The sensitive data call requests that meet the target call cycle during the time period of the sensitive data element call are extracted and summarized to generate sensitive data call requirement information for the target call cycle.

5. The sensitive data processing method as described in claim 1, characterized in that, Based on the sensitive data element call type and time period of each sensitive data call request in the sensitive data call request information, and considering the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption, a sensitive data processing strategy step is generated, specifically including: Based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, the storage space of the sensitive data server for sensitive data storage and call and the decryption time of the target fuzzy decryption algorithm for different decryption time periods are considered. The solution objective is to select sensitive data elements at different data structure locations in the structured sensitive dataset as fuzzy encryption elements and convert them to generate a structured fuzzy encrypted sensitive dataset. The number of generated structured fuzzy encrypted sensitive datasets and the allocation of each sensitive data access request to the structured fuzzy encrypted sensitive dataset are defined as the solution objective. The first constraint is that the total space occupied by the structured fuzzy encrypted sensitive dataset, determined by the number of generated datasets and the size of a single dataset, must be less than the storage space required by the sensitive data server for sensitive data storage and access. The second constraint is that each sensitive data element allocated to the structured fuzzy encrypted sensitive dataset in each time period... The second constraint is that the sensitive data element in the call request is included in the time period of the action, and other sensitive data elements other than the sensitive data element call type of each sensitive data call request are configured as fuzzy encryption elements. The optimization objective is to maximize the fuzzy decryption efficiency determined by the number of sensitive data elements in each sensitive data call request of the structured fuzzy encryption sensitive dataset allocated to each time period, the number of elements that need to be fuzzy decrypted, the decryption time of the sensitive data element call period and the decryption time of different decryption periods for the target fuzzy decryption algorithm. The optimization algorithm is used to solve the structured sensitive data fuzzy encryption sub-strategy and the data call fuzzy decryption generation sub-strategy. The sub-strategy for fuzzy encryption of structured sensitive data includes: selecting sensitive data elements at different data structure positions in the structured sensitive dataset as fuzzy encryption elements and converting them into the structured fuzzy encrypted sensitive dataset and the number of conversions of the structured fuzzy encrypted sensitive dataset; The data retrieval fuzzy decryption generation sub-strategy includes: the structured fuzzy encrypted sensitive data assigned to each sensitive data retrieval request.

6. The sensitive data processing method as described in claim 5, characterized in that, The step of sending the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, causing the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and constructing a sensitive data fuzzy encryption list specifically includes: The structured sensitive data fuzzy encryption sub-strategy is sent to the sensitive data server, which is then driven to perform fuzzy encryption before the target call cycle, generating several structured fuzzy encrypted sensitive datasets and constructing a sensitive data fuzzy encryption list. The fuzzy encryption action is configured to generate a corresponding number of structured fuzzy encrypted sensitive datasets based on the structured sensitive data fuzzy encryption sub-strategy, and the sensitive data elements whose corresponding data structure positions are selected as fuzzy encryption elements in each structured fuzzy encrypted sensitive dataset are fuzzy encrypted using the target fuzzy encryption algorithm.

7. The sensitive data processing method as described in claim 5, characterized in that, The data is invoked to generate a fuzzy decryption sub-strategy and sent to the sensitive data server. This prompts the sensitive data server to send the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data invocation terminal. The fuzzy decryption steps are then performed using the fuzzy decryption key, specifically including: The data is invoked to generate a fuzzy decryption sub-strategy and sent to the sensitive data server, which then drives the sensitive data server to generate a structured fuzzy encrypted sensitive dataset allocated in the sensitive data fuzzy encryption list for each data invocation terminal and a fuzzy decryption key corresponding to the target fuzzy encryption algorithm. The fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset in the sensitive data fuzzy encryption list are sent to the corresponding data calling terminal, which then uses the fuzzy decryption key to perform fuzzy decryption.

8. A sensitive data processing device, characterized in that, include: The acquisition module is used to acquire a structured sensitive dataset stored in a sensitive data server; wherein, several pieces of structured sensitive data in the structured sensitive dataset are configured to have the same data composition structure, and each piece of structured sensitive data includes several sensitive data elements corresponding to different data structure positions; The receiving module is used to receive sensitive data access requests uploaded by several data access terminals, and generate sensitive data access requirement information for the target access period based on the sensitive data access requests; The generation module is used to generate a sensitive data processing strategy based on the sensitive data element call type and sensitive data element call time period of each sensitive data call request in the sensitive data call request information, taking into account the storage space limitations of the sensitive data server and the efficiency of fuzzy decryption; wherein, the sensitive data processing strategy includes a structured sensitive data fuzzy encryption sub-strategy and a data call fuzzy decryption generation sub-strategy; The module is used to send the structured sensitive data fuzzy encryption sub-strategy to the sensitive data server, and drive the sensitive data server to generate several structured fuzzy encrypted sensitive datasets before the target call cycle, and construct a sensitive data fuzzy encryption list. The execution module is used to send the data to the fuzzy decryption generation sub-strategy to the sensitive data server, and to drive the sensitive data server to send the fuzzy decryption key and the index position of the assigned structured fuzzy encrypted sensitive dataset to the corresponding data call terminal, and to perform fuzzy decryption using the fuzzy decryption key.

9. A sensitive data processing device, characterized in that, The sensitive data processing device includes: a memory, a processor, and a sensitive data processing program stored in the memory and executable on the processor, wherein when the sensitive data processing program is executed by the processor, it implements the steps of the sensitive data processing method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a sensitive data processing program, which, when executed by a processor, implements the steps of the sensitive data processing method as described in any one of claims 1 to 7.

Images