Data desensitization method based on bastion host operation and maintenance and computer program product

Abstract

The invention provides a data desensitization method based on bastion host operation and maintenance, a computer program product, electronic equipment and a storage medium, and the method comprises the steps: obtaining communication traffic of bastion host operation and maintenance; analyzing the communication flow to obtain standardized format data; inputting the standardized format data into a pre-constructed large model for sensitive data identification to obtain sensitive data and a corresponding sensitive degree; querying a pre-constructed permission desensitization strategy mapping table according to the sensitive data and the corresponding sensitive degree to obtain a desensitization strategy; and desensitizing the sensitive data according to the desensitization strategy. By implementing the application, accurate classification and identification of sensitive data can be realized, different desensitization strategies can be carried out according to different protocol types, various fine-grained desensitization can be realized, desensitization can be carried out according to operation and maintenance rights, and the desensitization process is more flexible and controllable.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a data desensitization method based on bastion host operation and maintenance, computer program products, electronic devices, and storage media. Background Technology

[0002] While bastion hosts play a crucial role in identity authentication, access control, and operational auditing, they have many drawbacks when dealing with the risk of sensitive data leakage during operations and maintenance, such as: The risk of sensitive data leakage exists even if operations and maintenance personnel have legitimate permissions; they may still directly access, view, copy, or screenshot sensitive data during operation. The de-identification strategy is rigid and lacks flexibility; existing bastion hosts lack the ability to dynamically and differentiate the de-identification of data with different levels of sensitivity based on the roles and permissions of operations and maintenance personnel.

[0003] Existing technologies face technical bottlenecks when handling sensitive data during operations and maintenance. For example, they suffer from insufficient recognition capabilities, relying heavily on regular expressions and keyword matching rules, which struggle to handle multi-source heterogeneous data (especially image data) and complex semantic information, resulting in high false positive and false negative rates. Support for graphical operations and maintenance is limited, restricted to pixel-level blurring or masking of specific areas, making it difficult to accurately identify complex text content in graphics and perform content-level desensitization, let alone display different desensitization granularities based on different permissions. Furthermore, they rely on a single protocol, primarily focusing on data processing for a specific type of protocol, making expansion difficult. Finally, the desensitization granularity is insufficient, making it difficult to implement various fine-grained desensitization methods.

[0004] Meanwhile, most data anonymization tools or platforms only support static or offline data, which cannot meet the immediate protection needs of real-time and dynamic data in operation and maintenance scenarios. They also lack the ability to proxy operation and maintenance sessions and identify, intervene in, and modify data content in real time. They are mainly for structured or semi-structured data and have difficulty effectively processing unstructured or image data. Summary of the Invention

[0005] The purpose of this application is to provide a data desensitization method, computer program product, electronic device and storage medium based on bastion host operation and maintenance, which can achieve accurate classification and identification of sensitive data, and implement different desensitization strategies according to different protocol types, realize multiple fine-grained desensitization, and perform desensitization according to operation and maintenance permissions, making the desensitization process more flexible and controllable.

[0006] In a first aspect, embodiments of this application provide a data anonymization method based on bastion host operation and maintenance, the method comprising: Obtain the communication traffic of the bastion host operation and maintenance; The communication traffic is parsed to obtain standardized format data; The standardized format data is input into a pre-built large model to identify sensitive data and obtain the sensitive data and its corresponding sensitivity level. Based on the sensitive data and its corresponding sensitivity level, a pre-built permission de-identification policy mapping table is queried to obtain the de-identification policy; The sensitive data is desensitized according to the desensitization strategy.

[0007] In the above implementation process, sensitive data is identified based on a pre-built large model. Different desensitization strategies are selected according to different sensitive data and sensitivity levels. This enables accurate classification and identification of sensitive data. Different desensitization strategies are applied according to different protocol types, achieving multiple fine-grained desensitization. Desensitization can be performed according to operation and maintenance permissions, making the desensitization process more flexible and controllable.

[0008] Furthermore, the step of obtaining the communication traffic of the bastion host operation and maintenance includes: The bastion host is authenticated to obtain an operation and maintenance request; Intercept the communication traffic in the operation and maintenance request.

[0009] In the above implementation process, verifying the identity of the bastion host can ensure security, facilitate the maintenance of stable communication processes, achieve comprehensive interception of communication traffic, and avoid the risk of data leakage.

[0010] Furthermore, the step of parsing the communication traffic to obtain standardized format data includes: Obtain the operation and maintenance protocol type corresponding to the communication traffic; When the operation and maintenance protocol type of the communication traffic is a text-based protocol, the communication traffic is converted into text format data; When the operation and maintenance protocol type of the communication traffic is an image-based protocol, the communication traffic is converted into image frame format data; The text format data and the image frame format data are determined to be the standardized format data.

[0011] In the above implementation process, communication traffic is distinguished according to the type of operation and maintenance protocol, and data of different operation and maintenance protocol types are converted accordingly. This allows for fine division of data in the data preprocessing stage, improving the accuracy of subsequent de-identification.

[0012] Furthermore, the step of inputting the standardized format data into a pre-built large model for sensitive data identification to obtain sensitive data and its corresponding sensitivity level includes: Text-formatted data is input into a pre-built large model for sensitive data identification, resulting in sensitive text data. Image frame format data is input into a pre-built large model for sensitive data identification to obtain image sensitive data; Intent and risk assessments are performed on the sensitive text data and the sensitive image data respectively to obtain the sensitivity level corresponding to the sensitive text data and the sensitivity level corresponding to the sensitive image data; The text sensitive data and the image sensitive data are identified as the sensitive data, and the sensitivity level corresponding to the text sensitive data and the sensitivity level corresponding to the image sensitive data are identified as the sensitivity level.

[0013] In the above implementation process, a pre-built large model is used to identify sensitive data in text format data and image frame format data respectively. Different types of data can be distinguished in the initial stage of identification, so as to achieve accurate data classification and flexible control.

[0014] Further, the step of querying a pre-built permission de-identification policy mapping table based on the sensitive data and its corresponding sensitivity level to obtain the de-identification policy includes: Obtain the operation and maintenance permission level corresponding to the bastion host; Based on the operation and maintenance permission level, the sensitive data, and the sensitivity level, the permission de-identification policy mapping table is queried to obtain the de-identification policy corresponding to the sensitive data.

[0015] In the above implementation process, querying the permission desensitization strategy mapping table according to the operation and maintenance permission level, sensitive data and sensitivity level can improve the granularity of the desensitization process and make the desensitization process more precise and controllable.

[0016] Further, the step of desensitizing the sensitive data according to the desensitization strategy includes: The level of data masking is determined based on the aforementioned operation and maintenance permission level; Based on the stated desensitization intensity, different desensitization methods are selected in the desensitization strategy to desensitize the sensitive data.

[0017] In the above implementation process, different desensitization methods are selected according to the desensitization intensity, and different desensitization methods can be combined to achieve accurate desensitization of sensitive data, which is more flexible and has a wider range of applications.

[0018] Furthermore, the step of selecting different desensitization methods in the desensitization strategy to desensitize the sensitive data according to the desensitization intensity includes: If the sensitive data is text-sensitive data, a text desensitization method is selected from the corresponding text-type desensitization strategy according to the desensitization intensity; If the desensitized data is image-sensitive data, the image desensitization method is selected from the corresponding image desensitization strategy according to the desensitization intensity.

[0019] In the above implementation process, different desensitization methods are used to desensitize data according to different protocol types, which can improve the controllability of the desensitization process, realize multimodal desensitization and dynamic desensitization, and provide a guarantee for the security and stability of desensitization.

[0020] Furthermore, after the step of desensitizing the sensitive data according to the desensitization strategy, the method further includes: The data packet is reconstructed based on the de-identified sensitive data; The data packet is sent to the client.

[0021] In the above implementation process, the de-identified sensitive data is reconstructed and sent to the client, which can ensure the real-time nature of the de-identification process and avoid long waiting times for users.

[0022] Furthermore, after the step of desensitizing the sensitive data according to the desensitization strategy, the method further includes: An audit log is generated based on the data packets and the communication traffic, specifically including: Generate an anonymized display log based on the data packet; Generate the original operation log based on the communication traffic; The de-identified display log and the original operation log are identified as the audit log.

[0023] In the above implementation process, corresponding logs are generated from the communication traffic before and the data packets after the de-identification, which can trace the de-identification process, provide an important guarantee for the security of the de-identification method, and effectively avoid the leakage of user information.

[0024] Secondly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in any of the first aspects.

[0025] Thirdly, an electronic device provided in this application includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any of the first aspects.

[0026] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0027] Fifthly, embodiments of this application also provide a data anonymization device based on bastion host operation and maintenance, the device comprising: The acquisition module is used to acquire the communication traffic of the bastion host operation and maintenance. The parsing module is used to parse the communication traffic to obtain standardized format data; The sensitive data identification module is used to input the standardized format data into a pre-built large model to identify sensitive data and obtain the sensitive data and its corresponding sensitivity level. The query module is used to query a pre-built permission de-identification policy mapping table based on the sensitive data and its corresponding sensitivity level to obtain the de-identification policy; The desensitization module is used to desensitize the sensitive data according to the desensitization strategy.

[0028] In the above implementation process, sensitive data is identified based on a pre-built large model. Different desensitization strategies are selected according to different sensitive data and sensitivity levels. This enables accurate classification and identification of sensitive data. Different desensitization strategies are applied according to different protocol types, achieving multiple fine-grained desensitization. Desensitization can be performed according to operation and maintenance permissions, making the desensitization process more flexible and controllable.

[0029] Other features and advantages of this disclosure will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the techniques described above.

[0030] It can be implemented in accordance with the contents of the specification. The preferred embodiments of this application are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the range. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A flowchart illustrating the data anonymization method based on bastion host operation and maintenance provided in this application embodiment; Figure 2 A schematic diagram of the structural composition of the data desensitization device based on bastion host operation and maintenance provided in this application embodiment; Figure 3 This is a schematic diagram of the structural composition of the electronic device provided in the embodiments of this application. Detailed Implementation

[0033] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0034] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0035] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0036] Example 1 Figure 1 This is a flowchart illustrating the data anonymization method based on bastion host operation and maintenance provided in this application embodiment, as shown below. Figure 1 As shown, the method includes: S1, obtain the communication traffic of the bastion host operation and maintenance; S2 parses the communication traffic to obtain standardized format data; S3 involves inputting standardized format data into a pre-built large model to identify sensitive data and obtain the sensitive data and its corresponding sensitivity level. S4. Based on the sensitive data and its corresponding sensitivity level, query the pre-built permission de-identification policy mapping table to obtain the de-identification policy; S5, desensitize sensitive data according to the desensitization strategy.

[0037] In the above implementation process, sensitive data is identified based on a pre-built large model. Different desensitization strategies are selected according to different sensitive data and sensitivity levels. This enables accurate classification and identification of sensitive data. Different desensitization strategies are applied according to different protocol types, achieving multiple fine-grained desensitization. Desensitization can be performed according to operation and maintenance permissions, making the desensitization process more flexible and controllable.

[0038] Furthermore, the steps for obtaining communication traffic for bastion host operation and maintenance include: The bastion host is authenticated to receive the operation and maintenance request; Intercept communication traffic in operation and maintenance requests.

[0039] In the above implementation process, verifying the identity of the bastion host can ensure security, facilitate the maintenance of stable communication processes, achieve comprehensive interception of communication traffic, and avoid the risk of data leakage.

[0040] After the operations and maintenance personnel authenticate their identity through the bastion host, they can initiate various operations and maintenance requests to the target server (such as SSH, RDP, database client connections, and web browser access). The bastion host can also intercept and take over all communication traffic between the operations and maintenance personnel and the target server.

[0041] Further, the steps of parsing the communication traffic to obtain standardized format data include: Obtain the operation and maintenance protocol type corresponding to the communication traffic; When the communication traffic operation and maintenance protocol type is a text-based protocol, the communication traffic will be converted into text format data; When the communication traffic operation and maintenance protocol type is an image-based protocol, the communication traffic is converted into image frame format data; Determine that text format data and image frame format data are standardized format data.

[0042] In the above implementation process, communication traffic is distinguished according to the type of operation and maintenance protocol, and data of different operation and maintenance protocol types are converted accordingly. This allows for fine division of data in the data preprocessing stage, improving the accuracy of subsequent de-identification.

[0043] Based on different operation and maintenance protocol types, the original binary communication traffic is restored and transformed into standardized data that can be processed by large models: For data from text-based protocols (SSH, databases, web responses, etc.), it is parsed into plain text strings or text formats with specific structures (such as JSON, XML). Examples include the output of SSH commands, the result sets of SQL queries, and the HTML text content of web pages.

[0044] Data from image-based protocols (RDP, VNC, etc.) is parsed into a continuous sequence of image frames (e.g., a pixel stream from an RDP screen). For web browser access, web page content can also be converted into image frames using virtual browsers or screenshot techniques.

[0045] Furthermore, the steps of inputting standardized format data into a pre-built large model for sensitive data identification to obtain sensitive data and its corresponding sensitivity level include: Text-formatted data is input into a pre-built large model for sensitive data identification, resulting in sensitive text data. Image frame format data is input into a pre-built large model for sensitive data identification to obtain image sensitive data; Intent and risk assessments were performed on text-sensitive data and image-sensitive data respectively to obtain the sensitivity levels corresponding to text-sensitive data and image-sensitive data. Identify text-sensitive data and image-sensitive data as sensitive data, and determine the sensitivity level corresponding to the text-sensitive data and the sensitivity level corresponding to the image-sensitive data.

[0046] In the above implementation process, a pre-built large model is used to identify sensitive data in text format data and image frame format data respectively. Different types of data can be distinguished in the initial stage of identification, so as to achieve accurate data classification and flexible control.

[0047] In this application, the bastion host integrates or calls a large model with powerful semantic understanding and multimodal recognition capabilities through an API interface. The large model can be a large language model (LLM) or a multimodal large model (MLM).

[0048] The large model relies on pre-defined regular expressions and keywords to intelligently identify various types of sensitive text data through contextual understanding and semantic analysis, such as: personal ID numbers, mobile phone numbers, bank card numbers, email addresses, passwords, API keys, internal project names, customer names, etc. It also determines whether "Zhang San" in a specific context is a sensitive customer name that needs to be anonymized, rather than just an ordinary name.

[0049] The large model performs visual recognition and analysis on real-time image frames in RDP sessions, combining OCR (Optical Character Recognition) technology to accurately extract all text content in the images and perform sensitivity assessments on all text content. Simultaneously, the large model can understand the layout and UI elements in the images, thereby identifying and locating sensitive image data within specific regions (such as table data or specific UI elements).

[0050] By combining auxiliary information such as the operation commands of current maintenance personnel, the types of resources accessed, and historical behavior patterns, the large model can further assess the potential risks of the current operation and help determine the sensitivity of text-sensitive data and image-sensitive data in the current context.

[0051] Further, the steps of querying the pre-built permission de-identification policy mapping table based on sensitive data and its corresponding sensitivity level to obtain the de-identification policy include: Obtain the corresponding operation and maintenance permission level for the bastion host; Based on the operation and maintenance permission level, sensitive data, and sensitivity level, query the permission de-identification policy mapping table to obtain the de-identification policy corresponding to the sensitive data.

[0052] In the above implementation process, querying the permission desensitization strategy mapping table according to the operation and maintenance permission level, sensitive data and sensitivity level can improve the granularity of the desensitization process and make the desensitization process more precise and controllable.

[0053] The permission masking policy mapping table defines the specific masking methods and masking intensity to be adopted when accessing sensitive data of different permission levels (e.g., ordinary operation and maintenance, advanced operation and maintenance, security auditor) or different roles (e.g., database administrator, server administrator) and their respective access levels (e.g., extremely sensitive, highly sensitive, moderately sensitive).

[0054] Based on the current operation and maintenance personnel's permission level (operation and maintenance permission level), the type and sensitivity of sensitive data, the most matching de-identification strategy is found from the preset mapping table.

[0055] Furthermore, the steps for desensitizing sensitive data according to the desensitization strategy include: The level of data masking should be determined based on the level of operational and maintenance permissions. Different desensitization methods are selected in the desensitization strategy to desensitize sensitive data according to the degree of desensitization.

[0056] In the above implementation process, different desensitization methods are selected according to the desensitization intensity, and different desensitization methods can be combined to achieve accurate desensitization of sensitive data, which is more flexible and has a wider range of applications.

[0057] Furthermore, the steps of selecting different desensitization methods in the desensitization strategy to desensitize sensitive data according to the degree of desensitization include: If the sensitive data is text-sensitive data, select the text desensitization method from the corresponding text-type desensitization strategy according to the desensitization intensity; If the data to be desensitized is image-sensitive data, select the image desensitization method from the corresponding image desensitization strategy according to the desensitization intensity.

[0058] In the above implementation process, different desensitization methods are used to desensitize data according to different protocol types, which can improve the controllability of the desensitization process, realize multimodal desensitization and dynamic desensitization, and provide a guarantee for the security and stability of desensitization.

[0059] Methods for de-identifying sensitive text data include: Partial masking: For example, desensitize the mobile phone number 13812345678 to 138××××5678.

[0060] Complete masking: For example, desensitize the password password123 to ××××××××.

[0061] Intelligent replacement: Leveraging the text generation capabilities of large models, it replaces data with semantically relevant but insensitive fake data. For example, it replaces a customer's name "Zhang San" with "a certain user," or replaces a real address with a virtual address.

[0062] Hash / encryption display: Display sensitive data after one-way hashing or encryption, suitable for scenarios that require verification but do not require plaintext.

[0063] Methods for desensitizing image-sensitive data include: Pixel-level blurring: blurs pixels in sensitive areas, making them unrecognizable while preserving the original layout.

[0064] Masking / Covering: Overlays an opaque rectangle, mosaic pattern, or watermark on sensitive areas in real time to completely obscure the content.

[0065] Intelligent Image Content Replacement: An advanced form of RDP desensitization. Through a large model's understanding of image content and layout, it replaces sensitive text areas (such as the ID number column in a table) with desensitized text content (e.g., 138××××5678) or generates blank / non-sensitive content while keeping the original image UI layout and elements unchanged.

[0066] Furthermore, after desensitizing sensitive data according to the desensitization strategy, the process also includes: The data packet is reconstructed based on the de-identified sensitive data; Send the data packet to the client.

[0067] In the above implementation process, the de-identified sensitive data is reconstructed and sent to the client, which can ensure the real-time nature of the de-identification process and avoid long waiting times for users.

[0068] The sensitive text data after desensitization is reconstructed by directly modifying the text string. The sensitive image data after desensitization is also reconstructed by performing real-time pixel-level or content-level processing on image frames of protocols such as RDP to generate desensitized image frames. Then, the processed text content and image frames are generated into a data packet and sent to the client.

[0069] The entire desensitization process of this application occurs entirely on the bastion host side, and is completely transparent and imperceptible to the terminals of the operation and maintenance personnel. The terminal devices of the operation and maintenance personnel will not receive any original sensitive data.

[0070] Furthermore, after desensitizing sensitive data according to the desensitization strategy, the process also includes: Audit logs are generated based on data packets and communication traffic, specifically including: Generate an anonymized display log based on the data packet; Generate raw operation logs based on communication traffic; The de-identified display logs and the original operation logs were identified as audit logs.

[0071] In the above implementation process, corresponding logs are generated from the communication traffic before and the data packets after the de-identification, which can trace the de-identification process, provide an important guarantee for the security of the de-identification method, and effectively avoid the leakage of user information.

[0072] To ensure the integrity of the audit and the ability to trace back afterward, this application implements "dual recording" of all operation and maintenance operations.

[0073] The original operation logs fully record the commands actually executed and the communication traffic accessed by the operations and maintenance personnel (including raw data under text protocols and sensitive data and context identified by large models under image protocols). They are encrypted and stored with strict access control, allowing only authorized high-privilege auditors to decrypt and view them.

[0074] The de-identified display log records the de-identified data packets actually seen by operations and maintenance personnel on the terminal. This includes the de-identified text output and the de-identified RDP session recordings.

[0075] The aforementioned audit logs contain detailed timestamps, operator identities, operation details, sensitive data types, application of data masking strategies, and unique identifiers before and after data masking. This allows for rapid location of relevant sessions and audit records, and intelligently links and displays the corresponding original sensitive data or masked content based on the auditor's permissions, significantly improving audit efficiency and event tracing capabilities.

[0076] For example, suppose two maintenance personnel from a financial institution, "Xiao Wang" (privilege level: ordinary maintenance) and "Lao Li" (privilege level: advanced maintenance), need to maintain a database server in the production environment through a bastion host. The database contains sensitive data such as customer names, ID numbers, and bank card numbers.

[0077] Xiao Wang logs into the bastion host and passes authentication (multi-factor authentication). Xiao Wang requests access to the production database server and opens an SSH terminal and web interface to access the internal financial system.

[0078] Mr. Li logs into the bastion host and is successfully authenticated. Mr. Li then requests access to the same production database server and opens an RDP remote desktop connection to another business server.

[0079] The bastion host acts as an intermediary proxy for all operational traffic, intercepting the session traffic between Xiao Wang and Lao Li, specifically including SSH traffic, web traffic, and RDP image streams, and performing real-time parsing.

[0080] The SSH traffic output is restored to text, the web traffic is parsed into HTML text, and the RDP image stream is decoded into continuous image frames.

[0081] The large model identifies the parsed data and returns sensitive data, including name, mobile phone number, ID card number, and card number.

[0082] The large model receives this text data and uses its semantic understanding capabilities to not only identify data that conforms to specific rules, such as ID card numbers and bank card numbers, but also intelligently determine whether "customer name" is sensitive information that needs to be de-identified in the current operation, and mark and classify it (e.g., personal identity information).

[0083] Mr. Li accessed the internal financial reporting system via RDP, and a complex table containing customer names, transaction amounts, and bank card numbers was displayed on the screen.

[0084] The large model receives real-time image frames from RDP and first extracts all text content from the image using a high-precision OCR module. Then, the large model performs a comprehensive analysis of the extracted text content, its location within the image, font, and the overall image layout. Leveraging its ability to understand visual and textual information, the large model can intelligently determine which text regions constitute sensitive information (e.g., the entire column containing a bank card number) and identify their specific locations.

[0085] Based on the operation and maintenance permission level, sensitive data, and sensitivity level, query the permission de-identification policy mapping table to obtain the de-identification policy corresponding to the sensitive data.

[0086] The anonymization strategy requires masking ID card numbers and bank card numbers, while customer names and mobile phone numbers do not need to be masked. The anonymization level can be determined based on the maintenance access level: when ordinary maintenance personnel view customer information, bank card numbers must be completely masked and ID card numbers must be partially masked; senior maintenance personnel can see part of the bank card number and the complete ID card number.

[0087] Therefore, by combining the above-mentioned desensitization methods according to their desensitization strength, we can obtain the following results: ID card number: partially masked (e.g., 3301××××123X), bank card number: completely masked (e.g., ××××××××××××), customer name and mobile phone number: not desensitized.

[0088] The same anonymization method was used on Mr. Li (senior operations and maintenance personnel), and the results were as follows: ID number: not anonymized (displayed in plain text), bank card number: partially obscured (e.g., 622200××××××1234), customer name and mobile phone number: not anonymized.

[0089] For the sensitive area in the RDP image (Lao Li's RDP session), the large model identified the sensitive table area containing bank card numbers on the RDP screen. Based on Lao Li's "advanced operations and maintenance" privileges, the desensitization strategy instructed that the area be blurred at the pixel level. This means that the pixels in this area are processed by the algorithm to make them blurry, but it is still possible to roughly distinguish that the area is a table, rather than being completely blank or crudely covered, thus allowing Lao Li to understand the context to some extent.

[0090] For Xiao Wang's SSH session, according to the data anonymization policy, the text content is modified in real time before the original text result returned by the database reaches Xiao Wang's terminal. For example, specific digits of the ID card number are replaced with asterisks (or other symbols), and all digits of the bank card number are replaced with asterisks. The modified text content is then sent to Xiao Wang's SSH terminal.

[0091] For Lao Li's RDP session, after receiving the RDP image frame from the target server, the bastion host does not forward it directly. Instead, it performs real-time pixel-level processing on sensitive areas identified by the large model within the image frame. Then, it repackages the processed image frame into an RDP protocol data stream and sends it to Lao Li's RDP client. This ensures a smooth operational experience.

[0092] The original operation log will fully record the original commands executed by Xiao Wang and Lao Li, as well as the original, un-anonymized data returned by the server. For RDP sessions, it will record the original image frame captures, accurately marking the original sensitive information identified by the large model and its location. All raw data will be stored encrypted and access permissions will be strictly controlled.

[0093] The de-identified display log records the de-identified content that maintenance personnel actually see on the terminal. This includes the de-identified text output and the de-identified RDP session recordings.

[0094] Auditors can log in to the bastion host and use natural language queries (e.g., "Find the sensitive bank card number area in all financial statements that Lao Li has viewed in the RDP session and display its original content") to analyze the auditor's query intent, quickly locate relevant sessions and audit records, and intelligently associate and display the corresponding original sensitive data or de-identified content according to the auditor's permissions, which greatly improves audit efficiency and event traceability.

[0095] This application achieves intelligent, multimodal sensitive data desensitization. Leveraging the powerful semantic understanding, multimodal recognition, and content generation capabilities of a large-scale model, it identifies various types of sensitive data in text and images, overcoming the limitations of traditional rule matching and OCR, and significantly improving the accuracy and coverage of recognition. Simultaneously, it can determine data sensitivity based on context, avoiding false desensitization. Not only does it support multiple desensitization methods, but it can also dynamically adjust the desensitization intensity based on the permission level of operations and maintenance personnel and the type and sensitivity of sensitive data, assisted by the large-scale model, achieving on-demand and role-based differentiated desensitization, balancing security and operational efficiency.

[0096] The de-identification process in this application occurs entirely on the bastion host side, without requiring modification to the target system, business application code, or the client software of the operations and maintenance personnel.

[0097] The bastion host in this application can simultaneously record both the original sensitive data and the anonymized displayed content, ensuring the integrity and traceability of audit logs. Combined with large-scale model capabilities, auditors can perform natural language queries and intelligent correlation analysis, greatly improving audit efficiency and event tracing capabilities.

[0098] Example 2 This application provides a computer program product that, when run on a computer, causes the computer to perform any of the methods described in Embodiment 1.

[0099] Example 3 To execute the method corresponding to Embodiment 1 above and achieve the corresponding functional and technical effects, a data desensitization device based on bastion host operation and maintenance is provided below, such as... Figure 2 As shown, the device includes: Module 1 is used to acquire communication traffic for bastion host operation and maintenance; Parsing module 2 is used to parse communication traffic and obtain standardized format data; Sensitive data identification module 3 is used to input standardized format data into a pre-built large model for sensitive data identification, and to obtain sensitive data and its corresponding sensitivity level; Query module 4 is used to query a pre-built permission de-identification policy mapping table based on sensitive data and its corresponding sensitivity level to obtain the de-identification policy; The desensitization module 5 is used to desensitize sensitive data according to the desensitization strategy.

[0100] In the above implementation process, sensitive data is identified based on a pre-built large model. Different desensitization strategies are selected according to different sensitive data and sensitivity levels. This enables accurate classification and identification of sensitive data. Different desensitization strategies are applied according to different protocol types, achieving multiple fine-grained desensitization. Desensitization can be performed according to operation and maintenance permissions, making the desensitization process more flexible and controllable.

[0101] Furthermore, module 1 is also used for: The bastion host is authenticated to receive the operation and maintenance request; Intercept communication traffic in operation and maintenance requests.

[0102] In the above implementation process, verifying the identity of the bastion host can ensure security, facilitate the maintenance of stable communication processes, achieve comprehensive interception of communication traffic, and avoid the risk of data leakage.

[0103] Furthermore, parsing module 2 is also used for: Obtain the operation and maintenance protocol type corresponding to the communication traffic; When the communication traffic operation and maintenance protocol type is a text-based protocol, the communication traffic will be converted into text format data; When the communication traffic operation and maintenance protocol type is an image-based protocol, the communication traffic is converted into image frame format data; Determine that text format data and image frame format data are standardized format data.

[0104] In the above implementation process, communication traffic is distinguished according to the type of operation and maintenance protocol, and data of different operation and maintenance protocol types are converted accordingly. This allows for fine division of data in the data preprocessing stage, improving the accuracy of subsequent de-identification.

[0105] Furthermore, the sensitive data identification module 3 is also used for: Text-formatted data is input into a pre-built large model for sensitive data identification, resulting in sensitive text data. Image frame format data is input into a pre-built large model for sensitive data identification to obtain image sensitive data; Intent and risk assessments were performed on text-sensitive data and image-sensitive data respectively to obtain the sensitivity levels corresponding to text-sensitive data and image-sensitive data. Identify text-sensitive data and image-sensitive data as sensitive data, and determine the sensitivity level corresponding to the text-sensitive data and the sensitivity level corresponding to the image-sensitive data.

[0106] In the above implementation process, a pre-built large model is used to identify sensitive data in text format data and image frame format data respectively. Different types of data can be distinguished in the initial stage of identification, so as to achieve accurate data classification and flexible control.

[0107] Furthermore, query module 4 is also used for: Obtain the corresponding operation and maintenance permission level for the bastion host; Based on the operation and maintenance permission level, sensitive data, and sensitivity level, query the permission de-identification policy mapping table to obtain the de-identification policy corresponding to the sensitive data.

[0108] In the above implementation process, querying the permission desensitization strategy mapping table according to the operation and maintenance permission level, sensitive data and sensitivity level can improve the granularity of the desensitization process and make the desensitization process more precise and controllable.

[0109] Furthermore, the desensitization module 5 is also used for: The level of data masking should be determined based on the level of operational and maintenance permissions. Different desensitization methods are selected in the desensitization strategy to desensitize sensitive data according to the degree of desensitization.

[0110] In the above implementation process, different desensitization methods are selected according to the desensitization intensity, and different desensitization methods can be combined to achieve accurate desensitization of sensitive data, which is more flexible and has a wider range of applications.

[0111] Furthermore, the desensitization module 5 is also used for: If the sensitive data is text-sensitive data, select the text desensitization method from the corresponding text-type desensitization strategy according to the desensitization intensity; If the data to be desensitized is image-sensitive data, select the image desensitization method from the corresponding image desensitization strategy according to the desensitization intensity.

[0112] In the above implementation process, different desensitization methods are used to desensitize data according to different protocol types, which can improve the controllability of the desensitization process, realize multimodal desensitization and dynamic desensitization, and provide a guarantee for the security and stability of desensitization.

[0113] Furthermore, the device also includes a reconfiguration module for: The data packet is reconstructed based on the de-identified sensitive data; Send the data packet to the client.

[0114] In the above implementation process, the de-identified sensitive data is reconstructed and sent to the client, which can ensure the real-time nature of the de-identification process and avoid long waiting times for users.

[0115] Furthermore, the device also includes a generation module for: Audit logs are generated based on data packets and communication traffic, specifically including: Generate an anonymized display log based on the data packet; Generate raw operation logs based on communication traffic; The de-identified display logs and the original operation logs were identified as audit logs.

[0116] In the above implementation process, corresponding logs are generated from the communication traffic before and the data packets after the de-identification, which can trace the de-identification process, provide an important guarantee for the security of the de-identification method, and effectively avoid the leakage of user information.

[0117] The data anonymization device based on bastion host operation and maintenance described above can implement the method of Embodiment 1. The options in Embodiment 1 also apply to this embodiment, and will not be described in detail here.

[0118] The remaining contents of this embodiment can be referred to the contents of Embodiment 1 above, and will not be repeated in this embodiment.

[0119] Example 4 This application provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to perform the data desensitization method based on bastion host operation and maintenance as described in Embodiment 1.

[0120] Alternatively, the aforementioned electronic device may be a server.

[0121] Please see Figure 3 , Figure 3 This is a schematic diagram illustrating the structural composition of an electronic device provided in an embodiment of this application. The electronic device may include a processor 31, a communication interface 32, a memory 33, and at least one communication bus 34. The communication bus 34 is used to enable direct communication between these components. In this embodiment, the communication interface 32 is used for signaling or data communication with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0122] The processor 31 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 31 can be any conventional processor.

[0123] The memory 33 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions. When these computer-readable instructions are executed by the processor 31, the device can perform the aforementioned operations. Figure 1 The various steps involved in the method implementation examples.

[0124] Optionally, the electronic device may also include a storage controller and an input / output unit. The memory 33, storage controller, processor 31, peripheral interface, and input / output unit are electrically connected directly or indirectly to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via a communication bus 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the device.

[0125] Input / output units are used to enable users to create tasks and set optional start periods or preset execution times for those tasks, facilitating user-server interaction. Input / output units can be, but are not limited to, a mouse and keyboard.

[0126] Understandable. Figure 3 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3 The components shown can be implemented using hardware, software, or a combination thereof.

[0127] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data desensitization method based on bastion host operation and maintenance as described in Embodiment 1.

[0128] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using dedicated hardware-based apparatus that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0130] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0131] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0132] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0133] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

[0134] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A data desensitization method based on bastion operation and maintenance, characterized in that, The method comprises: acquiring the communication traffic of the bastion host operation and maintenance; parsing the communication traffic to obtain standardized format data; inputting the standardized format data into a pre-constructed large model to identify sensitive data and obtain the corresponding sensitive degree; querying a pre-constructed permission desensitization strategy mapping table according to the sensitive data and the corresponding sensitive degree to obtain a desensitization strategy; desensitizing the sensitive data according to the desensitization strategy.

2. The data desensitization method based on the bastion machine operation and maintenance according to claim 1, wherein The step of acquiring the communication traffic of the bastion host operation and maintenance comprises: verifying the identity of the bastion host to obtain an operation and maintenance request; intercepting the communication traffic of the communication in the operation and maintenance request.

3. The data desensitization method based on the bastion machine operation and maintenance according to claim 1, wherein, The step of parsing the communication traffic to obtain standardized format data comprises: acquiring the operation and maintenance protocol type corresponding to the communication traffic; when the operation and maintenance protocol type of the communication traffic is a text protocol, converting the communication traffic into text format data; when the operation and maintenance protocol type of the communication traffic is an image protocol, converting the communication traffic into image frame format data; determining that the text format data and the image frame format data are the standardized format data.

4. The data desensitization method based on the bastion machine operation and maintenance according to claim 1, characterized in that, The step of inputting the standardized format data into a pre-constructed large model to identify sensitive data and obtain the corresponding sensitive degree comprises: inputting text format data into a pre-constructed large model to identify sensitive data and obtain text sensitive data; inputting image frame format data into a pre-constructed large model to identify sensitive data and obtain image sensitive data; respectively performing intent and risk assessment on the text sensitive data and the image sensitive data to obtain the sensitive degree corresponding to the text sensitive data and the sensitive degree corresponding to the image sensitive data; determining that the text sensitive data and the image sensitive data are the sensitive data, and determining that the sensitive degree corresponding to the text sensitive data and the sensitive degree corresponding to the image sensitive data are the sensitive degree.

5. The data desensitization method based on the bastion machine operation and maintenance according to claim 1, wherein, The step of querying a pre-constructed permission desensitization strategy mapping table according to the sensitive data and the corresponding sensitive degree to obtain a desensitization strategy comprises: acquiring the operation and maintenance permission level corresponding to the bastion host; querying the permission desensitization strategy mapping table according to the operation and maintenance permission level, the sensitive data, and the sensitive degree to obtain the desensitization strategy corresponding to the sensitive data.

6. The data desensitization method based on the bastion machine operation and maintenance according to claim 5, characterized in that, The step of desensitizing the sensitive data according to the desensitization strategy comprises: determining the desensitization intensity according to the operation and maintenance permission level; selecting different desensitization methods in the desensitization strategy according to the desensitization intensity to desensitize the sensitive data.

7. The data desensitization method based on bastion operation and maintenance according to claim 6, characterized in that, The step of selecting different desensitization methods in the desensitization strategy according to the desensitization intensity to desensitize the sensitive data comprises: if the sensitive data is text sensitive data, selecting a text desensitization method in the corresponding text desensitization strategy according to the desensitization intensity to desensitize; if the desensitization data is image sensitive data, selecting an image desensitization method in the corresponding image desensitization strategy according to the desensitization intensity to desensitize.

8. The data desensitization method based on the bastion machine operation and maintenance according to claim 1, characterized in that, The step of desensitizing the sensitive data according to the desensitization strategy further comprises: reconstructing according to the desensitized sensitive data to obtain a data packet; sending the data packet to the client.

9. The data desensitization method based on bastion operation and maintenance according to claim 8, characterized in that, The step of desensitizing the sensitive data according to the desensitization strategy further comprises: generating an audit log according to the data packet and the communication traffic, specifically comprising: generating a desensitized display log according to the data packet; generating an original operation log according to the communication traffic; determining that the desensitized display log and the original operation log are the audit log.

10. A computer program product, characterised in that, The computer program product, when running on a computer, causes the computer to execute the method of any one of claims 1 to 9.

11. An electronic device, comprising: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the data desensitization method based on bastion host operation and maintenance according to any one of claims 1 to 9.

12. A storage medium, characterized by The computer program is stored in the memory and is executed by the processor to implement the data desensitization method based on bastion host operation and maintenance according to any one of claims 1 to 9.

Images