Data query method for sensitive data, and electronic device, storage medium and computer program product

Abstract

Provided in the embodiments of the present disclosure are a data query method for sensitive data, and an electronic device, a storage medium and a computer program product. In the embodiments of the present disclosure, when an access terminal queries sensitive data in a database system, the database system sequentially performs desensitization processing and encryption processing on the sensitive data. Thus, provided is a data protection solution in which encryption is combined with desensitization, what flows out of the database system is encrypted desensitized data, and what the access terminal obtains after decryption is desensitized data rather than sensitive data. Sensitive data is protected by means of encryption during data transmission. In addition, what an access terminal obtains is desensitized data rather than sensitive data, thereby effectively reducing the risk of leakage of the sensitive data.

Description

[0001] The data query method of sensitive data, electronic equipment, storage medium and computer program product cross-refer to the present disclosure claims priority to the Chinese patent application with the application number 202410748697.4, the title of which is "data query method of sensitive data, electronic equipment, storage medium and computer program product", filed on June 11, 2024 with the China Patent Office, the entire content of which is incorporated herein by reference. TECHNICAL FIELD The present disclosure relates to the technical field of data security, in particular to a data query method of sensitive data, electronic equipment, storage medium and computer program product. BACKGROUND Currently, there are often sensitive data in the data stored by the database system. In order to effectively protect the sensitive data, after receiving the access request of the access terminal, the database system encrypts the data requested to be accessed by the access terminal to obtain ciphertext data, and transmits the ciphertext data to the access terminal, thereby reducing the probability of sensitive data leakage in the database system during data transmission. However, the ciphertext data is presented in plaintext form after decryption at the access terminal. In this way, even if the data is protected by encryption during data transmission, there is still a risk of sensitive data leakage during data processing after decryption at the access terminal. INVENTION The present disclosure provides a data query method of sensitive data, electronic equipment, storage medium and computer program product, which effectively reduces the risk of sensitive data leakage. The present disclosure provides a data query method of sensitive data, which is applied to a database system, and the method comprises: in response to a query request of an access terminal, querying field data of a target sensitive field in the database system; performing desensitization processing on the field data of the target sensitive field to obtain a desensitization result; performing encryption processing on the desensitization result to obtain ciphertext desensitization result; and sending the ciphertext desensitization result to the access terminal for the access terminal to decrypt the ciphertext desensitization result to obtain the desensitization result. The present disclosure provides an electronic equipment, which comprises a memory and a processor; the memory is configured to store a computer program; and the processor is coupled to the memory and is configured to execute the computer program to perform the steps in the data query method of sensitive data. The present disclosure provides a computer-readable storage medium storing a computer program, which enables the processor to implement the steps in the data query method of sensitive data when the computer program is executed by the processor. The present disclosure provides a computer program product comprising a computer program / instruction, which enables the processor to implement the steps in the data query method of sensitive data when the computer program / instruction is executed by the processor.The embodiment of the disclosure provides a sensitive data query method, an electronic device, a storage medium and a computer program product. In the embodiment of the disclosure, when a terminal accesses sensitive data in a database system, the database system performs desensitization and encryption processing on the sensitive data in sequence. Thus, a data protection scheme of encryption and desensitization superposition is provided. The desensitized data after encryption flows out from the database system, and the terminal decrypts the desensitized data instead of the sensitive data. On the one hand, the sensitive data is protected by encryption during data transmission, and on the other hand, the terminal obtains the desensitized data instead of the sensitive data, thereby effectively reducing the risk of sensitive data leakage. The accompanying drawings are used to provide a further understanding of the disclosure, and form a part of the disclosure. The illustrative embodiments of the disclosure and their descriptions serve to explain the disclosure, and do not constitute an improper limitation on the disclosure. In the drawings: Fig. 1 is a schematic diagram of an application scenario provided by the embodiment of the disclosure; Fig. 2 is a signaling interaction diagram of a sensitive data query method provided by the embodiment of the disclosure; Fig. 3 is a flowchart of a sensitive data query method provided by the embodiment of the disclosure; Fig. 4 is a system architecture diagram to which an exemplary sensitive data query method provided by the embodiment of the disclosure is applicable; Fig. 5 is another signaling interaction diagram of a sensitive data query method provided by the embodiment of the disclosure; Fig. 6 is a structural schematic diagram of a data processing apparatus provided by the embodiment of the disclosure; and Fig. 7 is a structural schematic diagram of an electronic device provided by the embodiment of the disclosure. In the specific embodiments of the disclosure, “at least one” means one or more, “multiple” means two or more, and “and / or” describes the access relationship between the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there can be three situations: A alone, A and B together, and B alone, where A and B can be singular or plural. In the textual description of the disclosure, the character “ / ” generally indicates that the associated objects before and after it have an “or” relationship. In addition, in the embodiments of the disclosure, “first”, “second”, “third”, etc. are only used to distinguish the contents of different objects, and have no other special meanings.Currently, sensitive data often exists in the data stored in a database system. In order to effectively protect the sensitive data, after receiving an access request from an access terminal, the database system encrypts the data requested by the access terminal to obtain ciphertext data, and transmits the ciphertext data to the access terminal, thereby reducing the probability of leakage of sensitive data in the database system in the data transmission process. However, after the ciphertext data is decrypted at the access terminal, the data is presented in plaintext form. In this way, even if the data is protected by encryption in the data transmission process, there is still a risk of leakage of sensitive data in the data processing stage after decryption at the access terminal. In view of this, the embodiments of the present disclosure provide a sensitive data data query method, an electronic device, a storage medium and a computer program product. In the embodiments of the present disclosure, when the access terminal queries sensitive data in the database system, the database system performs desensitization and encryption processing on the sensitive data in sequence. Thus, a data protection scheme of superimposed encryption and desensitization is provided, and the desensitized data after encryption flows out from the database system, and the access terminal decrypts to obtain the desensitized data instead of the sensitive data. On the one hand, the sensitive data is protected by encryption in the data transmission process, and on the other hand, the access terminal obtains the desensitized data instead of the sensitive data, thereby effectively reducing the risk of leakage of sensitive data. FIG. 1 is a schematic diagram of an application scenario provided by the embodiments of the present disclosure. In actual application, a database table (Table) includes a plurality of fields (Field), and the field (Field) is a data unit or component of a specific type stored in the database table (Table). In the fields provided by the database table, there are often some sensitive fields. For example, in an employee information table, “name”, “age”, “gender”, “date of employment”, “salary” and the like are sensitive fields. In order to reduce the risk of leakage of sensitive data, a relevant rule configuration person such as a database administrator can configure a sensitive rule for the sensitive field. The sensitive rule can be a rule for protecting sensitive data configured flexibly on demand, and the sensitive rule includes but is not limited to, for example: a customizable desensitization algorithm, a system default desensitization algorithm, a customizable encryption algorithm and a system default encryption algorithm and an authorized user list for the sensitive field. The customizable desensitization algorithm refers to a desensitization algorithm with algorithm parameters customizable by an access user, and the system default desensitization algorithm refers to a desensitization algorithm with fixed algorithm parameters. The customizable encryption algorithm refers to an encryption algorithm with algorithm parameters customizable by an access user, and the system default encryption algorithm refers to an encryption algorithm with fixed algorithm parameters. The visibility of the sensitive field can be different for different access users. Specifically, some access users only have the permission to view part of the field data of the sensitive field, that is, the sensitive field is partially visible to the access user.Some access users have no permission to view the field data of the sensitive field, that is, the sensitive field is completely invisible to the access user. Some access users have permission to view the field data of the entire sensitive field, that is, the sensitive field is completely visible to the access user. The rule configuration personnel can configure the corresponding authorized user list for the sensitive field as needed, and the authorized user in the authorized user list has permission to view all or part of the field data of the sensitive field. It can be understood that if the access user does not belong to the authorized user in the authorized user list, the access user has no permission to view the field data of the sensitive field. Optionally, for the access user who does not belong to the authorized user in the authorized user list, a default permission can also be set for such access user, and the default permission is flexibly set as needed, for example, the default permission includes but is not limited to: no permission to view the field data of the sensitive field, permission to view part of the field data of the sensitive field, or permission to view all the field data of the sensitive field, and the like. In actual application, as shown in ① and ② in FIG. 1, the rule configuration personnel performs the configuration operation of configuring the sensitive rule for the sensitive field on the configuration terminal, and triggers the configuration terminal to send the sensitive rule to the database system for storing the sensitive rule locally by the database system, thereby completing the configuration process of the sensitive rule. In the data access stage, referring to ③ and ④ in FIG. 1, the database system responds to the query request sent by the access terminal of the access user to query the sensitive data (that is, the field data of the sensitive field requested to be queried). The database system determines whether the sensitive data needs to be desensitized based on the sensitive rule, and in the case of needing desensitization, sequentially performs desensitization and encryption on the sensitive data to obtain the ciphertext sensitive data. Referring to ⑤ and ⑥ shown in FIG. 1, the database system sends the ciphertext sensitive data to the access terminal, and the access terminal decrypts the ciphertext data to obtain the desensitized data. In this way, the access terminal presents the desensitized data instead of the sensitive data, which greatly reduces the probability of leakage of the sensitive data. Of course, if the access user is authorized to have permission to view all the sensitive data, that is, the sensitive data is completely visible to the access user, at this time, the database system determines that the sensitive data does not need to be desensitized based on the sensitive rule, and can only be encrypted to obtain the encryption result, and the access terminal decrypts the encryption result to obtain the sensitive data. The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The technical solutions provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings. FIG. 2 is a signaling interaction diagram of a sensitive data query method provided by an embodiment of the present disclosure. Referring to FIG. 2, the method can include the following steps:

[0002] 201、 The access terminal sends a query request to the database system.

[0003] 202、 The database system queries the field data of the target sensitive field in the database system in response to the query request of the access terminal.

[0004] 203、 The database system performs desensitization processing on the field data of the target sensitive field to obtain a desensitization result.

[0005] 204、 The database system performs encryption processing on the desensitization result to obtain a ciphertext desensitization result.

[0006] 205、 The database system sends the ciphertext desensitization result to the access terminal.

[0007] 206、 The access terminal decrypts the ciphertext desensitization result to obtain the desensitization result. In actual application, the access terminal can be understood as a client of the database system, and the client can be any device or application program capable of initiating a request and interacting with the database system to access and operate data. The access terminal includes, but is not limited to, terminal devices such as desktop computers, personal computers, smart phones, tablets, vehicle-mounted devices, and Internet of Things devices. Of course, the access terminal can also be an application program installed on a terminal device, and no limitation is made in this regard. In actual application, the database system includes, but is not limited to, a relational database, a non-relational database, a cloud-native database, or a data warehouse, but is not limited thereto. Which fields in the database table provided by the database system are sensitive fields and which fields are not sensitive fields can be flexibly specified as needed, and no limitation is made in this regard. In actual application, when a data accesser (also referred to as an access user) has a query requirement for data in the database system, the access terminal of the access user sends a query request to the database system. Usually, the query request can include the field name of the field to be queried, for example, the query of “name”, “age”, “gender”, “date of employment”, “salary income”, etc. For example, a structured query language (SQL) query request is SELECT name FROM employee information table, that is, to find the field data of the “name” field from the employee information table. The database system can determine whether the field to be queried is a sensitive field in response to the query request received by the access terminal. If the field to be queried is not a sensitive field, the database system can provide the field data of the queried field to the access terminal. If the field to be queried is a sensitive field, the database system performs data protection processing on the field data of the queried sensitive field, and provides the field data of the sensitive field after data protection processing to the access terminal. Further optionally, the query request sent by the access terminal is encrypted, and the database system needs to decrypt the encrypted query request before executing the query request to improve the security of data access. In order to facilitate understanding and differentiation, the sensitive field to be queried by the access terminal is referred to as a target sensitive field. In actual application, the manner of data protection processing on the field data of the target sensitive field is not limited. For example, the data protection processing on the field data of the target sensitive field can be only desensitization processing. For another example, the data protection processing on the field data of the target sensitive field can be only encryption processing.Unlike traditional Transport Layer Security (TLS) transport encryption, TLS transport encryption is visible to data plaintext at intermediate nodes of a link. The embodiments of the present disclosure only access data plaintext visible to a terminal. The TLS transport encryption key is randomly generated by a communication session and is uncontrollable by a user, while the encryption key used by the embodiments of the present disclosure is a user-manageable key, and only the key holder can decrypt the data. For example, the data protection processing for the field data of the target sensitive field can be to sequentially perform desensitization processing and encryption processing on the field data of the target sensitive field. It can be understood that, compared to performing only a single data protection processing such as desensitization processing or encryption processing on sensitive data, performing double data protection processing such as desensitization processing and encryption processing on sensitive data can more effectively reduce the risk of sensitive data leakage. In actual application, the database system can use any desensitization algorithm to perform desensitization processing on the field data of the target sensitive field, and no limitation is made in this regard. Further optionally, in order to improve the flexibility and reliability of desensitization processing and more effectively reduce the risk of sensitive data leakage, the system also supports flexibly configuring a self-defined desensitization algorithm and a system default desensitization algorithm corresponding to each sensitive field according to different sensitive fields. The self-defined desensitization algorithm refers to a desensitization algorithm whose algorithm parameters can be defined by an access user, and therefore, the self-defined desensitization algorithm can meet the diversified desensitization needs of different access users, from slight privacy protection to deep privacy protection. The system default desensitization algorithm is a desensitization algorithm whose algorithm parameters are fixed, and therefore, the system default desensitization algorithm serves as a backup for desensitization processing and guarantees the reliability of desensitization processing. In the embodiments of the present disclosure, the desensitization algorithm includes but is not limited to a replacement desensitization algorithm, a mask desensitization algorithm, a hash algorithm, an encryption algorithm, and the like. The replacement desensitization algorithm can replace part or all of the content in sensitive data with non-sensitive content, for example, replace a real name with “anonymous user” or replace the last four digits of a phone number with “****”. The algorithm parameters of the replacement desensitization algorithm that can be defined by an access user include but are not limited to a replacement mode, a replacement digit number, and a reserved digit position. The replacement mode defines which non-sensitive content is used for replacement, and the non-sensitive content includes but is not limited to an asterisk (*), a random character, a fixed character, and the like. The replacement digit number is used to determine how many digits are replaced, for example, a mobile phone number only displays the first three digits and the last four digits, and the middle digits are replaced with an asterisk. The reserved digit position is used to determine which characters in the position are not reserved and which are replaced. The mask desensitization algorithm can replace part or all of the content in sensitive data with a specific character (such as an asterisk *, X) or other placeholders to hide part of the sensitive information in the data.Masking algorithm is suitable for data with fixed format, such as phone number, credit card number or identity authentication number. Masking algorithm can be customized by algorithm parameters of access user, such as but not limited to: masking mode, masking bit number, reserved bit position. Masking mode defines which non-sensitive content is used for masking, such as but not limited to: asterisk (*), random character, fixed character, etc. Masking bit number is used to determine how many bits are masked, for example, only the first three and the last four digits of a mobile phone number are displayed, and the middle part is masked. Reserved bit position is used to determine which position of the character is not reserved and which is masked. Hash algorithm can use hash function to convert sensitive data into fixed length, irreversible hash value, in order to achieve the purpose of protecting data privacy. Hash algorithm can be customized by algorithm parameters of access user, such as but not limited to: hash algorithm type, salt value, iteration number, etc. Hash algorithm type includes but is not limited to: Secure Hash Algorithm 1 (SHAT) and Secure Hash Algorithm 256 (SHA-256). Salt value can increase random string to improve hash uniqueness; increasing iteration number enhances security. Encryption algorithm is used as desensitization algorithm, which protects sensitive data by encrypting sensitive data. Encryption algorithm can be customized by algorithm parameters of access user, such as but not limited to: key, key derivation function, encryption algorithm type, etc. Encryption algorithm type includes but is not limited to: symmetric encryption algorithm and asymmetric encryption algorithm. In practical application, when configuring custom desensitization algorithm and / or system default desensitization algorithm for sensitive fields, different desensitization algorithms can be configured according to the data type and / or sensitivity level of the sensitive field. For example, for numerical sensitive fields, replacement desensitization algorithm can be used; for text sensitive fields, masking desensitization algorithm can be used. The higher the sensitivity level of the sensitive field, the higher the security strength of the corresponding desensitization algorithm. For example, in the order of sensitivity level from low to high, the fields are arranged in the order of: name field, salary field, account password field. The name field is partially masked, the salary field is fully masked, and the account password field is desensitized by hash algorithm, etc.Based on the above, further optionally, the field data of the target sensitive field is desensitized to obtain a desensitization result, the implementation manner is: if the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field, the custom desensitization algorithm is used to desensitize the field data of the target sensitive field to obtain the desensitization result; if the access user is not configured with a corresponding custom desensitization algorithm for the target sensitive field, the system default desensitization algorithm pre-configured for the target sensitive field is used to desensitize the field data of the target sensitive field to obtain the desensitization result. In actual application, the way in which the database system judges whether the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field is not limited. For example, the database system pre-saves the corresponding relationship among the access user, the sensitive field, and the custom desensitization algorithm; if the database system queries in the corresponding relationship that the access user currently initiating the query request is configured with a custom desensitization algorithm for the target sensitive field, the database system confirms that the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field; otherwise, the database system confirms that the access user is not configured with a corresponding custom desensitization algorithm for the target sensitive field. For another example, the query request initiated by the access user carries a custom desensitization algorithm, and the database system confirms that the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field. Otherwise, the query request initiated by the access user does not carry a custom desensitization algorithm, and the database system confirms that the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field. Further optionally, in order to improve the flexibility of desensitization processing and meet diversified desensitization requirements, the database system can judge whether the access user is configured with a corresponding custom desensitization algorithm for the target sensitive field by querying whether the desensitization algorithm configuration information is parsed from the query request. Specifically, the database system responds to that the desensitization algorithm configuration information is parsed from the query request, the desensitization algorithm configuration information includes the identifier and the algorithm parameter of the custom desensitization algorithm, writes the corresponding algorithm parameter into the custom desensitization algorithm template according to the identifier of the custom desensitization algorithm to obtain the custom desensitization algorithm; and responds to that the desensitization algorithm configuration information is not parsed from the query request, determines that the access user is not configured with a corresponding custom desensitization algorithm for the target sensitive field. In actual application, the database system can save the system default desensitization algorithm and a plurality of optional custom desensitization algorithm templates pre-configured by relevant personnel for each sensitive field. The custom desensitization algorithm template can be understood as a custom desensitization algorithm that has not been configured with algorithm parameters, and the custom desensitization algorithm template includes one or more fill-in items. One or more algorithm parameters are filled into the corresponding fill-in item of the custom desensitization algorithm template to obtain the custom desensitization algorithm.In actual application, the database system can send the identification of the optional customized de-identification algorithm configured for the target sensitive field to the access terminal, so that the access terminal selects the identification of the customized de-identification algorithm from the identification of the optional customized de-identification algorithm, and configures the de-identification algorithm configuration information for the target de-identification field based on the selected identification of the customized de-identification algorithm. When the de-identification algorithm configuration information is configured for the target de-identification field based on the selected identification of the customized de-identification algorithm, the access terminal can configure the algorithm parameters corresponding to the selected customized de-identification algorithm in response to the configuration operation of the access user, and generate the de-identification algorithm configuration information based on the selected identification of the customized de-identification algorithm and the algorithm parameters corresponding to the selected customized de-identification algorithm. When the access terminal initiates the query request, the de-identification algorithm configuration information can be carried in the query request, so as to indicate the identification of the customized de-identification algorithm and the algorithm parameters selected by the access user for the target sensitive field to the database system through the de-identification algorithm configuration information. The database system selects the corresponding customized de-identification algorithm template according to the identification of the customized de-identification algorithm in the de-identification algorithm configuration information, and fills the algorithm parameters in the de-identification algorithm configuration information into the corresponding customized de-identification algorithm template to obtain the customized de-identification algorithm. In the embodiment, if the query request sent by the access terminal does not carry the de-identification algorithm configuration information, it is determined that the access user does not configure the corresponding customized de-identification algorithm for the target sensitive field, at this time, the database system can obtain the system default de-identification algorithm configured for the target sensitive field, and performs de-identification processing on the field data of the target sensitive field to obtain a de-identification result. In actual application, the database system can configure the same or different encryption algorithms for different fields, and no limitation is made in this regard. The database system can perform encryption processing on the field data of any field, or can perform encryption processing on the field data of the sensitive field, and no limitation is made in this regard. In the embodiment, the de-identification result obtained by performing de-identification processing on the field data of the target sensitive field is encrypted by using the encryption algorithm to obtain a ciphertext de-identification result. The database system can perform encryption processing on the de-identification result by using any encryption algorithm, and no limitation is made in this regard. Further optionally, in order to improve the flexibility and reliability of the encryption processing and more effectively reduce the risk of sensitive data leakage, the customized encryption algorithm and the system default encryption algorithm corresponding to each sensitive field are also supported to be flexibly configured on demand for different sensitive fields. The customized encryption algorithm refers to the encryption algorithm whose algorithm parameters can be customized by the access user, so that the customized encryption algorithm can meet the diversified encryption requirements of different access users, from slight privacy protection to deep privacy protection. The system default encryption algorithm refers to the encryption algorithm whose algorithm parameters are fixed, so that the system default encryption algorithm serves as a backup for the encryption processing and ensures the reliability of the encryption processing.Based on the above, further optionally, the desensitization result is encrypted to obtain the ciphertext desensitization result. If the access user is configured with a corresponding custom encryption algorithm for the target sensitive field, the desensitization result is encrypted using the custom encryption algorithm to obtain the ciphertext desensitization result. If the access user does not configure the corresponding custom encryption algorithm for the target sensitive field, the desensitization result is encrypted using the system default encryption algorithm configured in advance for the target sensitive field to obtain the ciphertext desensitization result. In actual application, the database system does not limit the way of judging whether the access user is configured with a corresponding custom encryption algorithm for the target sensitive field. For example, the database system pre-stores the correspondence among the access user, the sensitive field, and the custom encryption algorithm. If the database system queries the custom encryption algorithm configured for the target sensitive field by the access user who initiates the current query request in the correspondence, the database system confirms that the access user is configured with a corresponding custom encryption algorithm for the target sensitive field. Otherwise, the database system confirms that the access user does not configure the corresponding custom encryption algorithm for the target sensitive field. For another example, the query request initiated by the access user carries the custom encryption algorithm, and the database system confirms that the access user is configured with a corresponding custom encryption algorithm for the target sensitive field. Otherwise, the query request initiated by the access user does not carry the custom encryption algorithm, and the database system confirms that the access user does not configure the corresponding custom encryption algorithm for the target sensitive field. Further optionally, in order to improve the flexibility of encryption processing and meet diversified encryption requirements, the database system can determine whether the access user is configured with a corresponding custom encryption algorithm for the target sensitive field by querying whether the encryption algorithm configuration information is parsed from the query request. Specifically, the database system responds to the encryption algorithm configuration information parsed from the query request, which includes the identifier and algorithm parameters of the custom encryption algorithm, writes the corresponding algorithm parameters into the custom encryption algorithm template to obtain the custom encryption algorithm. In response to not parsing the encryption algorithm configuration information from the query request, it is determined that the access user does not configure the corresponding custom encryption algorithm for the target sensitive field. In actual application, the database system can store the system default encryption algorithm and multiple optional custom encryption algorithm templates configured in advance for each sensitive field by relevant personnel. The custom encryption algorithm template can be understood as a custom encryption algorithm that has not been configured with algorithm parameters. The custom encryption algorithm template includes one or more fill-in items. One or more algorithm parameters are filled into the corresponding fill-in items in the custom encryption algorithm template to obtain the custom encryption algorithm.In actual application, the database system can send the identifier of the optional custom encryption algorithm configured for the target sensitive field to the access terminal, so that the access terminal selects the identifier of the custom encryption algorithm from the identifier of the optional custom encryption algorithm, and configures the encryption algorithm configuration information for the target encryption field based on the selected identifier of the custom encryption algorithm. When configuring the encryption algorithm configuration information for the target encryption field based on the selected identifier of the custom encryption algorithm, the access terminal can configure the algorithm parameters corresponding to the selected custom encryption algorithm in response to the configuration operation of the access user, and generate the encryption algorithm configuration information based on the selected identifier of the custom encryption algorithm and the algorithm parameters corresponding to the selected custom encryption algorithm. When the access terminal initiates the query request, the encryption algorithm configuration information can be carried in the query request, so as to indicate the identifier of the custom encryption algorithm and the algorithm parameters selected by the access user for the target sensitive field to the database system through the encryption algorithm configuration information. The database system selects the corresponding custom encryption algorithm template according to the identifier of the custom encryption algorithm in the encryption algorithm configuration information, and fills the algorithm parameters in the encryption algorithm configuration information into the corresponding custom encryption algorithm template to obtain the custom encryption algorithm. In the embodiment, if the query request sent by the access terminal does not carry the encryption algorithm configuration information, it is determined that the access user does not configure the corresponding custom encryption algorithm for the target sensitive field, at this time, the database system can obtain the system default encryption algorithm configured for the target sensitive field in advance to perform encryption processing on the desensitization result to obtain the ciphertext desensitization result. The data query method for sensitive data provided in the embodiment of the present disclosure is used when the access terminal queries the sensitive data in the database system, and the database system sequentially performs desensitization and encryption processing on the sensitive data. Thus, a data protection scheme of encryption and desensitization is provided, and the desensitized data is obtained after decryption by the access terminal, instead of the sensitive data. On the one hand, the sensitive data is protected by encryption during data transmission, and on the other hand, the access terminal obtains the desensitized data, instead of the sensitive data, thereby effectively reducing the risk of sensitive data leakage. In some optional embodiments, the data of the sensitive field can also be protected in combination with the visibility of the access user corresponding to the access terminal, thereby improving the flexibility of data protection of the sensitive data while ensuring the security of the sensitive data. Another data query method for sensitive data will be described below with reference to FIG. 3. FIG. 3 is a flowchart of a data query method for sensitive data provided in an embodiment of the present disclosure. The method is applied to a database system, as shown in FIG. 3, and can include the following steps.

[0008] 301、 In response to the query request of the access terminal, the field data of the target sensitive field is queried in the database system.

[0009] 302、 identify the visibility of the target sensitive field to an access user corresponding to the access terminal, execute step 303 or step 306 oIn actual applications, the visibility of the same sensitive field to different access users can be different, that is, the viewing permission of different access users to the same sensitive field is different. Specifically, the visibility of the sensitive field to the access user can be divided into the following types: the sensitive field is completely visible to the access user, the sensitive field is partially visible to the access user, and the sensitive field is completely invisible to the access user. The sensitive field is completely visible to the access user, that is, the access user is authorized to obtain or view all field data of the sensitive field, and all field data of the sensitive field is completely transparent and visible to the access user. The sensitive field is partially visible to the access user, that is, the access user is authorized to obtain or view part of the field data of the sensitive field, and part of the field data of the sensitive field is transparent and visible to the access user; another part of the field data of the sensitive field is non-transparent and invisible to the access user. The sensitive field is completely invisible to the access user, that is, the access user is not authorized to obtain or view the field data of the sensitive field, and all field data of the sensitive field is non-transparent and invisible to the access user. In actual applications, the way in which the database system identifies the visibility of the target sensitive field to the access user corresponding to the access terminal is not limited. For example, the database system analyzes the historical access data of the access user to identify the security risk of the access user. If the security risk of the access user is high, the target sensitive field is completely invisible to the access user; if the security risk of the access user is medium, the target sensitive field is partially visible to the access user; and if the security risk of the access user is low, the target sensitive field is visible to the access user. For another example, the database system can set different visibility corresponding to different access time periods. After big data mining analysis, the security risk of the database system in the first access time period is high, the target sensitive field is completely invisible to the access user who initiates a query request in the first access time period; the security risk of the database system in the second access time period is general, the target sensitive field is partially visible to the access user who initiates a query request in the second access time period; and the security risk of the database system in the second access time period is low, the target sensitive field is completely invisible to the access user who initiates a query request in the third access time period.Further optionally, in order to better distinguish the visibility of the target sensitive field to the access user, and efficiently and accurately perform permission control on the sensitive data, an implementation manner of identifying the visibility of the target sensitive field to the access user corresponding to the access terminal is as follows: obtaining an authorized user list configured for the target sensitive field, wherein the authorized user list comprises a user identifier of a first authorized user and a user identifier of a second authorized user, the target sensitive field is totally visible to the first authorized user, and the target sensitive field is partially visible to the second authorized user; matching the user identifier of the access user with the user identifiers in the authorized user list; and identifying the visibility of the target sensitive field to the access user according to the matching result. In actual application, when the visibility of the target sensitive field to the access user corresponding to the access terminal is identified according to the matching result, if the user identifier of the access user matches the user identifier of the first authorized user successfully, it is determined that the target sensitive field is totally visible to the access user; if the user identifier of the access user matches the user identifier of the second authorized user successfully, it is determined that the target sensitive field is partially visible to the access user; and if the user identifier of the access user fails to match the user identifiers in the authorized user list, it is determined that the target sensitive field is totally invisible to the access user.

[0010] 303、 If the target sensitive field is totally invisible or partially visible to the access user, the field data of the target sensitive field is desensitized to obtain a desensitization result. In actual application, if the target sensitive field is totally invisible to the access user, the field data of the target sensitive field is desensitized to obtain the desensitization result; and if the target sensitive field is partially visible to the access user, the field data of the target sensitive field is desensitized to obtain the desensitization result.

[0011] 304、 The desensitization result is encrypted to obtain a ciphertext desensitization result.

[0012] 305、 The ciphertext desensitization result is sent to the access terminal, so that the access terminal decrypts the ciphertext desensitization result to obtain the desensitization result. For more information about the desensitization, encryption and decryption of the field data of the target sensitive field, please refer to the related content of the foregoing embodiments, which will not be repeated here.

[0013] 306、 If the target sensitive field is totally visible to the access user, the field data of the target sensitive field is encrypted to obtain an encryption result. The encryption of the field data of the target sensitive field and the encryption of the desensitization result obtained by desensitizing the field data of the target sensitive field are similar or the same, which will not be repeated here.

[0014] 307、 The encryption result is sent to the access terminal, and the access terminal decrypts the encryption result to obtain the field data of the target sensitive field. In this embodiment, if the target sensitive field is completely visible to the access user, the database system can not need to perform desensitization processing on the field data of the target sensitive field, but only needs to perform encryption processing, so that after the access terminal decrypts the encryption result, the field data of the target sensitive field in plaintext form can be obtained. It can be understood that even if the access terminal can obtain the field data of the target sensitive field in plaintext form, the security of such a data protection scheme is still very high because the access user is an authorized user. Of course, if the data protection processing on the field data of the target sensitive field is only desensitization processing on the field data of the target sensitive field, if the target sensitive field is completely invisible or partially visible to the access user, the field data of the target sensitive field is desensitized to obtain a desensitization result, and the desensitization result is sent to the access terminal; if the target sensitive field is completely visible to the access user, the field data of the target sensitive field is sent to the access terminal. If the data protection processing on the field data of the target sensitive field is only encryption processing on the field data of the target sensitive field, if the target sensitive field is completely invisible or partially visible to the access user, the field data of the target sensitive field is encrypted to obtain an encryption result, and the encryption result is sent to the access terminal; if the target sensitive field is completely visible to the access user, the field data of the target sensitive field is directly sent to the access terminal. The data query method for sensitive data provided in the embodiments of the present disclosure can be used when the access terminal queries sensitive data in the database system. The database system identifies the visibility of the sensitive data to the access user, and differentially protects the sensitive data based on the identification result, thereby improving the flexibility of data protection of the sensitive data while ensuring the security of the sensitive data. In the above embodiments, the way in which the authorized user list configured for the sensitive field, the system default desensitization algorithm, the system default encryption algorithm, the optional custom desensitization algorithm template, or the optional custom encryption algorithm template is not limited. In actual applications, relevant configuration personnel such as database managers can configure sensitive rules, and the sensitive rules can include but are not limited to the authorized user list configured for the sensitive field, the system default desensitization algorithm, the system default encryption algorithm, the optional custom desensitization algorithm template, or the optional custom encryption algorithm template. In actual applications, the configuration personnel can configure corresponding sensitive rules for different granularity data objects such as databases, database tables, and columns as needed.For example, a unified sensitive rule is configured for each database, or a unified sensitive rule is configured for each database table, or a corresponding sensitive rule is configured for a specific column field. The sensitive rule can indicate that the field data of the sensitive field is not subjected to data protection processing, or the sensitive rule indicates that the field data of the sensitive field is only subjected to desensitization processing, or the sensitive rule indicates that the field data of the sensitive field is only subjected to encryption processing, or the sensitive rule indicates that the field data of the sensitive field is subjected to encryption and desensitization processing. In actual application, the configuration terminal of the configuration personnel issues the sensitive rule to the database system for the database system to locally save the sensitive rule. Further optionally, in order to avoid malicious issuance of the sensitive rule by an unauthorized user, the sensitive rule issued by the configuration terminal can be subjected to legality verification, and after the verification passes, the database system locally saves the sensitive rule. Based on this, the database system responds to the sensitive rule and signature information thereof sent by the configuration terminal; the signature information is verified, and if the signature information passes the verification, the sensitive rule is locally saved. In actual application, the sensitive rule can be subjected to digital signature processing to obtain the signature information of the sensitive rule. In the embodiment, the configuration terminal can be any device or application program that can initiate a request and interact with the database system to access and operate data. The configuration terminal includes, but is not limited to, a terminal device such as a desktop computer, a personal computer, a smart phone, a tablet computer, a vehicle-mounted device, or an Internet of Things device. Of course, the configuration terminal can also be an application program installed on the terminal device, and no limitation is made in this regard. In order to better understand the technical solutions provided by the embodiments of the present disclosure, a scene embodiment will be introduced below in combination with FIG. 4 and FIG. 5. In the system architecture shown in FIG. 4, the decryption component provided by the client provides decryption function, the security gateway (SecureGW) in the database system provides data protection function, and the SQL query engine executes SQL query operation. The security gateway is not limited to be applied in the database system, but can also be applied in other application systems. FIG. 5 is a signaling interaction diagram of another sensitive data data query method provided by the embodiments of the present disclosure. Referring to FIG. 5, the sensitive data data query method can include the following steps.

[0015] 501, the user configures a sensitive rule. The user can specify a sensitive rule for the sensitive field, and the sensitive rule can be only subjected to encryption processing, only subjected to desensitization processing, or subjected to desensitization and encryption processing in sequence, and no limitation is made in this regard. The client of the user issues the sensitive rule to the security gateway in the database system, and the database system locally saves the sensitive rule.

[0016] 502, initiate the SQL query. In the data access phase, the user's client sends the SQL query to the SQL query engine in the database system.

[0017] 503, execute the SQL query operation.

[0018] The SQL query engine executes the SQL query operation to obtain the plaintext query result.

[0019] 504, obtain the plaintext query result.

[0020] 505, obtain the ciphertext desensitization result. The security gateway performs data protection processing on the plaintext query result based on the sensitive rule. For example, if the sensitive rule includes a desensitization algorithm, the plaintext query result is desensitized to obtain a plaintext desensitization result. If the sensitive rule includes an encryption algorithm, the plaintext desensitization result is encrypted to obtain a ciphertext desensitization result.

[0021] 506, execute decryption.

[0022] 507, to obtain the plaintext desensitization result. The plaintext desensitization result is decrypted by a decryption component of the client to obtain the plaintext desensitization result and provide the plaintext desensitization result to the user. Of course, the sensitive rule can also not include a desensitization algorithm or an encryption algorithm, that is, no desensitization processing or encryption processing is required. FIG. 6 is a structural schematic diagram of a data processing apparatus provided by an embodiment of the present disclosure. The apparatus can be composed of hardware and / or software, and the apparatus can be applied to a database system. Referring to FIG. 6, the apparatus can include: a query component 61 configured to query field data of a target sensitive field in a database system in response to a query request of an access terminal; a desensitization component 62 configured to perform desensitization processing on the field data of the target sensitive field to obtain a desensitization result; an encryption component 63 configured to perform encryption processing on the desensitization result to obtain a ciphertext desensitization result; and a sending component 64 configured to send the ciphertext desensitization result to the access terminal, so that the access terminal decrypts the ciphertext desensitization result to obtain the desensitization result. Optionally, the apparatus further includes an identification trigger desensitization component 62 configured to perform desensitization processing on the field data of the target sensitive field to obtain the desensitization result in response to the target sensitive field being completely invisible or partially visible to an access user corresponding to the access terminal. Optionally, in response to the target sensitive field being completely invisible to the access user corresponding to the access terminal, the desensitization component 62 performs desensitization processing on all of the field data of the target sensitive field to obtain the desensitization result; and in response to the target sensitive field being partially visible to the access user, the desensitization component 62 performs desensitization processing on part of the field data of the target sensitive field to obtain the desensitization result. Optionally, in response to the target sensitive field being completely visible to the access user, the encryption component 63 is triggered to perform encryption processing on the field data of the target sensitive field to obtain an encryption result; and the sending component 64 is further configured to send the encryption result to the access terminal, so that the access terminal decrypts the encryption result to obtain the field data of the target sensitive field. Optionally, the identification component is configured to: obtain an authorized user list configured for the target sensitive field, wherein the authorized user list includes a user identifier of a first authorized user and a user identifier of a second authorized user, the target sensitive field is completely visible to the first authorized user, and the target sensitive field is partially visible to the second authorized user; match a user identifier of the access user with the user identifiers in the authorized user list; and identify the visibility of the target sensitive field to the access user according to a matching result.Optionally, the identifying component is configured to, according to the matching result, identify the visibility of the target sensitive field to the access user corresponding to the access terminal, and set that: in response to the matching result being that the user identifier of the access user matches the user identifier of the first authorized user successfully, it is determined that the target sensitive field is entirely visible to the access user; in response to the matching result being that the user identifier of the access user matches the user identifier of the second authorized user successfully, it is determined that the target sensitive field is partially visible to the access user; and in response to the user identifier of the access user failing to match the user identifier in the authorized user list, it is determined that the target sensitive field is entirely invisible to the access user. Optionally, the de-sensitizing component 62 is configured to: in response to the access user configuring a corresponding custom de-sensitizing algorithm for the target sensitive field, utilize the custom de-sensitizing algorithm to perform de-sensitizing processing on the field data of the target sensitive field, to obtain a de-sensitizing result; and in response to the access user not configuring a corresponding custom de-sensitizing algorithm for the target sensitive field, utilize a system default de-sensitizing algorithm pre-configured for the target sensitive field to perform de-sensitizing processing on the field data of the target sensitive field, to obtain a de-sensitizing result. Optionally, the de-sensitizing component 62 is further configured to: in response to de-sensitizing algorithm configuration information being parsed from the query request, the de-sensitizing algorithm configuration information including an identifier and algorithm parameters of a custom de-sensitizing algorithm, write the corresponding algorithm parameters into a custom de-sensitizing algorithm template according to the identifier of the custom de-sensitizing algorithm, to obtain the custom de-sensitizing algorithm; and in response to no de-sensitizing algorithm configuration information being parsed from the query request, determine that the access user does not configure a corresponding custom de-sensitizing algorithm for the target sensitive field. Optionally, the encrypting component 63 is configured to: in response to the access user configuring a corresponding custom encryption algorithm for the target sensitive field, utilize the custom encryption algorithm to perform encryption processing on the de-sensitizing result, to obtain a ciphertext de-sensitizing result; and in response to the access user not configuring a corresponding custom encryption algorithm for the target sensitive field, utilize a system default encryption algorithm pre-configured for the target sensitive field to perform encryption processing on the de-sensitizing result, to obtain a ciphertext de-sensitizing result. Optionally, the encrypting component 63 is further configured to: in response to encryption algorithm configuration information being parsed from the query request, the encryption algorithm configuration information including an identifier and algorithm parameters of a custom encryption algorithm, write the corresponding algorithm parameters into a custom encryption algorithm template according to the identifier of the custom encryption algorithm, to obtain the custom encryption algorithm; and in response to no encryption algorithm configuration information being parsed from the query request, determine that the access user does not configure a corresponding custom encryption algorithm for the target sensitive field.Optionally, the apparatus further comprises: a configuration component, configured to respond to sensitive rules and signature information of the configuration terminal sent by the configuration terminal, the sensitive rules comprising one or more of: a list of authorized users configured for a target sensitive field, a system default desensitization algorithm, a system default encryption algorithm, a custom desensitization algorithm template, and a custom encryption algorithm template; verifying the signature information; and in response to the signature information passing verification, saving the sensitive rules locally. The apparatus shown in FIG. 6 can perform the foregoing method embodiments, and the implementation principles and technical effects will not be described again. For each component of the apparatus shown in FIG. 6 in the foregoing embodiments, the specific manner in which the components perform operations has been described in detail in the related method embodiments, and will not be described in detail here. It should be noted that the execution subject of each step of the method provided in the foregoing embodiments can be the same device, or the method can also be executed by different devices as the execution subject. For example, the execution subject of steps 301 to 307 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of steps 303 to 307 can be device B; and so on. In addition, in some of the processes described in the foregoing embodiments and the accompanying drawings, a plurality of operations appear in a specific order, but it should be clear that the operations can be executed in the order in which they appear in this document or in parallel. The serial numbers of the operations, such as 301, 302, etc., are merely used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel. It should be noted that the descriptions “first”, “second”, etc. in this document are used to distinguish different messages, devices, components, etc., and do not represent the order of precedence. Also, “first” and “second” are different types. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use, and processing of related data need to comply with relevant national and regional laws, regulations, and standards, and provide appropriate operation entry for the user to choose authorization or refusal. FIG. 7 is a structural schematic diagram of an electronic device provided in an embodiment of the present disclosure. As shown in FIG. 7, the electronic device comprises a memory 71 and a processor 72; the memory 71 is configured to store a computer program and can be configured to store various other data to support operations on the computing platform.Examples of the data include instructions of any application program or method operating on the computing platform, contact data, phonebook data, messages, pictures, videos, etc. The memory 71 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random-access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic storage, a flash memory, a magnetic disk or an optical disk. The processor 72 is coupled with the memory 71 and configured to execute computer programs in the memory 71 to perform the steps in the data query method of the sensitive data. Optionally, as shown in FIG. 7, the electronic device further includes a communication component 73, a display 74, a power supply component 75, an audio component 76 and other components. The components shown in FIG. 7 are only schematic and do not mean that the electronic device only includes the components shown in FIG. 7. In addition, the components in the dashed box in FIG. 7 are optional components, not mandatory components, and the specific product form of the electronic device determines. The electronic device of the embodiment can be implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone or an I0T (Internet of things) device, or as a service end device such as a conventional server, a cloud server or a server array. If the electronic device of the embodiment is implemented as a terminal device such as a desktop computer, a notebook computer or a smart phone, it can include the components in the dashed box in FIG. 7; if the electronic device of the embodiment is implemented as a service end device such as a conventional server, a cloud server or a server array, it can not include the components in the dashed box in FIG. 7. The detailed implementation process of the processor performing each action can be referred to the related description in the foregoing method embodiment or device embodiment, which will not be described here. Accordingly, the embodiment of the disclosure also provides a computer readable storage medium storing a computer program, which can implement each step that can be performed by the electronic device in the foregoing method embodiment when the computer program is executed.Accordingly, the embodiments of the present disclosure also provide a computer program product including computer programs / instructions, which, when executed by a processor, enable the processor to implement the steps of the above-mentioned method embodiments that can be performed by an electronic device. The communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as a WiFi (Wireless Fidelity), 2G (2 Generation), 3G (3 Generation), 4G (4 Generation) / long term evolution (LTE), 5G (5 Generation) mobile communication network, or a combination thereof. In an example embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component also includes a near field communication (NFC) component to facilitate short-range communication. For example, the NFC component can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra wideband (UWB) technology, Bluetooth (BT) technology, and other technologies. The display includes a screen, which can include a liquid crystal display (LCD) and a touch panel (TP). OIf the screen includes a touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a slide and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touching or a slide action, but also detect duration and pressure related to the touching or slide operation. The above-mentioned power component provides power to various components of a device in which the power component is located. The power component can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for a device in which the power component is located. The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when a device in which the audio component is located is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signals can be further stored in a memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker configured to output audio signals. It will be appreciated by persons skilled in the art that the embodiments of the present disclosure can be provided as a method, a system, or a computer program product. Therefore, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Also, the present disclosure can take the form of a computer program product implemented on one or more computer-readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) containing computer usable program code. The present disclosure is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams.These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable devices to generate a computer-implemented process, so that the instructions executed on the computer or other programmable devices provide steps for implementing the functions specified in one or more flows in the flowchart and / or one or more blocks in the block diagram. In a typical configuration, the computing device includes one or more processors (Central Processing Unit, CPU for short), input / output interfaces, network interfaces, and memories. The memory can include non-permanent storage in the computer readable medium, random access memory (Random Access Memory, RAM for short) and / or non-volatile memory such as read-only memory (Read Only Memory, ROM for short) or flash memory (flash RAM). OMemory is an example of a computer-readable medium. Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented by any method or technology for storage of information such as computer-readable instructions, data structures, program components or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory, dynamic random access memory (DRAM), other types of random access memory, read-only memory, electrically erasable programmable read-only memory, flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers. It should also be noted that the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, method, article or device. Without more limitations, the element limited by the statement "including a ……" does not exclude the presence of another identical element in the process, method, article or device including the element. The above is only an embodiment of the disclosure and is not intended to limit the disclosure. The disclosure can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the disclosure should be included in the scope of the claims of the disclosure. The scheme provided by the embodiment of the disclosure can be applied in the process of data query, in response to the query request of the access terminal, the field data of the target sensitive field is queried in the database system; the field data of the target sensitive field is desensitized to obtain a desensitization result; the desensitization result is encrypted to obtain a ciphertext desensitization result; the ciphertext desensitization result is sent to the access terminal, so that the access terminal decrypts the ciphertext desensitization result to obtain the desensitization result, thereby solving the technical problem of high risk of sensitive data leakage.

Claims

CLAIM 1. A data query method of sensitive data, applied to a database system, the method comprising: In response to a query request of the access terminal, field data of a target sensitive field is queried in the database system; The field data of the target sensitive field is desensitized to obtain a desensitization result; The desensitization result is encrypted to obtain a ciphertext desensitization result; The ciphertext desensitization result is sent to the access terminal, so that the access terminal decrypts the ciphertext desensitization result to obtain the desensitization result.

2. The method of claim 1, wherein, The field data of the target sensitive field is desensitized to obtain a desensitization result, including: in response to the target sensitive field being invisible or partially visible to the access user corresponding to the access terminal, the field data of the target sensitive field is desensitized to obtain the desensitization result.

3. The method of claim 2, wherein, The field data of the target sensitive field is desensitized to obtain a desensitization result, including: in response to the target sensitive field being invisible or partially visible to the access user corresponding to the access terminal, the field data of the target sensitive field is desensitized to obtain the desensitization result.

4. The method of claim 2, wherein, The field data of the target sensitive field is desensitized to obtain a desensitization result, including: in response to the target sensitive field being invisible or partially visible to the access user corresponding to the access terminal, the field data of the target sensitive field is desensitized to obtain the desensitization result.

5. The method according to claim 2, wherein, The method further includes: in response to the target sensitive field being invisible to the access user, the field data of the target sensitive field is encrypted to obtain an encryption result; and the encryption result is sent to the access terminal, so that the access terminal decrypts the encryption result to obtain the field data of the target sensitive field.

6. The method of claim 2, wherein, The method further includes: obtaining an authorized user list configured for the target sensitive field, wherein the authorized user list includes a user identifier of a first authorized user and a user identifier of a second authorized user, the target sensitive field is invisible to the first authorized user, and the target sensitive field is partially visible to the second authorized user; The user identifier of the access user is matched with the user identifier in the authorized user list to obtain a matching result; and the visibility of the target sensitive field to the access user is identified according to the matching result.

7. The method of claim 6, wherein, The visibility of the target sensitive field to the access user corresponding to the access terminal is identified according to the matching result, including: in response to the matching result being that the user identifier of the access user is successfully matched with the user identifier of the first authorized user, it is determined that the target sensitive field is invisible to the access user.

8. The method of claim 6, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

9. The method of claim 6, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

10. The method according to claim 1, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

11. The method according to claim 1, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

12. The method according to claim 11, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

13. The method according to claim 7, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal.

14. The method according to claim 1, wherein, The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to the matching result, identifying the visibility of the target sensitive field to an access user corresponding to the access terminal. The method further comprises: in response to 15. The method according to claim 14, wherein, The method further comprises: in response to parsing the encryption algorithm configuration information from the query request, the encryption algorithm configuration information comprising the identification and algorithm parameters of the self-defined encryption algorithm, writing the corresponding algorithm parameters into a self-defined encryption algorithm template according to the identification of the self-defined encryption algorithm, and obtaining the self-defined encryption algorithm; and in response to not parsing the encryption algorithm configuration information from the query request, determining that the target sensitive field is not configured with the corresponding self-defined encryption algorithm by the access user.

16. The method according to any one of claims 1 to 15, wherein, The method further comprises, in response to the query request of the access terminal, before querying the field data of the target sensitive field in the database system, the following steps: in response to a sensitive rule sent by a configuration terminal and signature information of the configuration terminal, the sensitive rule comprising one or more of the following: an authorized user list configured for the target sensitive field, a system default desensitization algorithm, a system default encryption algorithm, a self-defined desensitization algorithm template, and a self-defined encryption algorithm template, verifying the signature information; and in response to the signature information passing the verification, saving the sensitive rule locally.

17. An electronic device, comprising: A memory and a processor; The memory is configured to store a computer program; The processor is coupled to the memory and is configured to execute the computer program to perform the steps in the method of any one of claims 1-16.

18. A computer readable storage medium storing a computer program, when the computer program is executed by a processor, causing the processor to be able to implement the steps in the method of any one of claims 1-16.

19. A computer program product, comprising computer program / instructions, when the computer program / instructions are executed by a processor, causing the processor to be able to implement the steps in the method of any one of claims 1-16.

Images