Confidential Information Identification Method, Device, Equipment and Computer Readable Storage Medium

Abstract

The present invention relates to the field of fintech, and discloses a method for identifying confidential information, including: when a development and release file is detected, scanning the script corresponding to the development and release file to obtain the DDL script corresponding to the development and release file; parsing the DDL script to extract the metadata information corresponding to the DDL script. Determining whether the metadata information matches the preset confidential information in the preset confidential information definition library; if it matches, marking the metadata information as confidential information. The present invention also discloses a confidential information identification device, equipment, and a computer-readable storage medium. Without reading the data content of the development and release file, the present invention extracts the corresponding metadata information by scanning the database script corresponding to the development and release file, and performs confidential marking on the metadata information to identify the sensitivity of the data corresponding to the development and release file, so as to manage data with different sensitivity levels.

Description

Technical Field

[0001] The present invention relates to the technical field of financial technology (Fintech), and particularly to a method, apparatus, device, and computer-readable storage medium for identifying confidential information. Background Art

[0002] In recent years, with the continuous development of financial technology (Fintech), especially Internet finance, data management technology has been introduced into the daily services of financial institutions such as banks. During the daily services of financial institutions, a lot of data is generated. Some data is important, and some data is unimportant. To distinguish the importance, it is often necessary to perform confidential identification on the data. Then, how to perform confidential identification on the data to achieve different storage, transmission, and use of different data, etc.

[0003] In the prior art, developers manually supplement data confidential information in the metadata management system, such as indicating that a certain field in the data is confidential information. In short, it is necessary to manually judge one by one whether there is a field with confidential information in the data. The entire process requires the participation of developers and needs to be judged among all fields, with high costs and low efficiency.

[0004] A more optimized method is to read all the data in the database. According to the characteristics of different confidential data, match them through regular expressions or other methods. If a match is found, it is indicated as confidential data, otherwise it is non-confidential data. For example, if the current data conforms to the format: ^(( / ( / d{3} / ))|( / d{3} / -))?13[456789] / d{8}|15

[89] / d{8}, then the data is identified as confidential data with the phone number being confidential information. However, this method requires configuring a superuser who can read all the data, and the risk exposure is relatively large. In the case of strict management of data permissions, it is almost impossible to obtain such superuser permissions. Moreover, in this process, all the data needs to be scanned, and confidential data only accounts for a small proportion after all, resulting in a waste of a large amount of computing resources.

[0005] Therefore, how to confirm whether the data is confidential data without reading the data to achieve different storage, transmission, and use of different data is an urgent problem to be solved. Summary of the Invention

[0006] The main purpose of the present invention is to propose a method, apparatus, device, and computer-readable storage medium for identifying confidential information, aiming to achieve the management of different data.

[0007] To achieve the above object, the present invention provides a method for identifying confidential information, and the method for identifying confidential information includes the following steps:

[0008] When a development release file is detected, scan the script corresponding to the development release file to obtain the DDL script corresponding to the development release file;

[0009] Parse the DDL script to extract the metadata information corresponding to the DDL script;

[0010] Determine whether the metadata information matches the preset confidential information in the preset confidential information definition library;

[0011] If it matches, mark the metadata information as confidential information.

[0012] Preferably, the step of when a development release file is detected, scanning the script of the development release file to obtain the DDL script corresponding to the development release file includes:

[0013] When a development release file is detected, read the release package of the development release file and extract the corresponding sql script from the release package;

[0014] Identify the corresponding DDL script from the sql script.

[0015] Preferably, the step of parsing the DDL script to extract the metadata information corresponding to the DDL script includes:

[0016] Extract the sql string from the DDL script and parse the DDL script into a corresponding abstract syntax tree based on the sql string;

[0017] Extract the corresponding metadata information from the abstract syntax tree.

[0018] Preferably, the metadata information includes the Chinese name of the field and the English name of the field, and the step of determining whether the metadata information matches the preset confidential information in the preset confidential information definition library includes:

[0019] Determine whether the Chinese name of the field is the same as the general Chinese name in the preset confidential information. If they are the same, determine that the metadata information matches the preset confidential information;

[0020] If they are not the same, determine whether the English name of the field is the same as the general English name in the preset confidential information. If they are the same, determine that the metadata information matches the preset confidential information.

[0021] Preferably, after the step of determining whether the English name of the field is the same as the general English name, the method further includes:

[0022] If they are not the same, calculate the first similarity between the Chinese name of the field and the general Chinese name;

[0023] Determine whether the first similarity reaches a first threshold. If so, determine that the metadata information matches the preset confidential information;

[0024] If not, calculate a second similarity between the English name of the field and the general English name;

[0025] Determine whether the second similarity reaches a second threshold. If so, determine that the metadata information matches the preset confidential information.

[0026] Preferably, the metadata information includes a field type, and the step of determining that the metadata information matches the preset confidential information includes:

[0027] Determine whether the field type is consistent with the general field type in the preset confidential information;

[0028] If they are consistent, determine that the metadata information matches the preset confidential information;

[0029] If they are not consistent, send the metadata information to an artificial judgment channel, and when receiving a confirmation message sent by the artificial judgment channel based on the metadata information, determine that the metadata information matches the preset confidential information.

[0030] Preferably, after the step of, if it matches, marking the metadata information as confidential information, the method further includes:

[0031] Write the metadata information into a preset confidential information definition library, so as to add the Chinese name, English name, and field type of the fields in the metadata information to the corresponding general Chinese name, general English name, and general field type respectively, so as to obtain an updated confidential information definition library.

[0032] In addition, to achieve the above object, the present invention also provides a confidential information marking device, and the confidential information marking device includes:

[0033] A scanning module, configured to scan a script corresponding to the development and release file when detecting the development and release file, so as to obtain a DDL script corresponding to the development and release file;

[0034] An analysis module, configured to analyze the DDL script to extract metadata information corresponding to the DDL script;

[0035] A determination module, configured to determine whether the metadata information matches preset confidential information in a preset confidential information definition library;

[0036] A marking module, configured to, if it matches, mark the metadata information as confidential information.

[0037] Preferably, the scanning module is further configured to:

[0038] When a development release file is detected, read the release package of the development release file, and extract the corresponding sql script from the release package;

[0039] Identify the corresponding DDL script from the sql script.

[0040] Preferably, the parsing module is further configured to:

[0041] Extract the sql string from the DDL script, and based on the sql string, parse the DDL script into a corresponding abstract syntax tree;

[0042] Extract the corresponding metadata information from the abstract syntax tree.

[0043] Preferably, the metadata information includes the Chinese name of the field and the English name of the field, and the determining module is further configured to:

[0044] Determine whether the Chinese name of the field is consistent with the common Chinese name in the preset confidential information. If they are consistent, determine that the metadata information matches the preset confidential information;

[0045] If they are not consistent, determine whether the English name of the field is consistent with the common English name in the preset confidential information. If they are consistent, determine that the metadata information matches the preset confidential information.

[0046] Preferably, the determining module is further configured to:

[0047] If they are not consistent, calculate the first similarity between the Chinese name of the field and the common Chinese name;

[0048] Determine whether the first similarity reaches a first threshold. If it does, determine that the metadata information matches the preset confidential information;

[0049] If not, calculate the second similarity between the English name of the field and the common English name;

[0050] Determine whether the second similarity reaches a second threshold. If it does, determine that the metadata information matches the preset confidential information.

[0051] Preferably, the determining module is further configured to:

[0052] Determine whether the field type is consistent with the common field type in the preset confidential information;

[0053] If they are consistent, determine that the metadata information matches the preset confidential information;

[0054] If they are inconsistent, send the metadata information to the manual judgment channel, and when receiving the confirmation information sent by the manual judgment channel based on the metadata information, determine that the metadata information matches the preset confidential information.

[0055] Preferably, the device further includes an update module for:

[0056] Write the metadata information into the preset confidential information definition library, so as to add the Chinese name, English name, and field type of the fields in the metadata information to the corresponding general Chinese name, general English name, and general field type respectively, so as to obtain an updated confidential information definition library.

[0057] In addition, to achieve the above object, the present invention also provides a confidential information identification device, which includes: a memory, a processor, and a confidential information identification program stored on the memory and operable on the processor. When the confidential information identification program is executed by the processor, the steps of the above-mentioned confidential information identification method are implemented.

[0058] In addition, to achieve the above object, the present invention also provides a computer-readable storage medium, on which a confidential information identification program is stored. When the confidential information identification program is executed by a processor, the steps of the above-mentioned confidential information identification method are implemented.

[0059] The confidential information identification method proposed by the present invention, when detecting a development and release file, scans the script corresponding to the development and release file to obtain the DDL script corresponding to the development and release file; parses the DDL script to extract the metadata information corresponding to the DDL script; determines whether the metadata information matches the preset confidential information in the preset confidential information definition library; if it matches, marks the metadata information as confidential information. Without reading the data content of the development and release file, the present invention scans the database script corresponding to the development and release file to extract the corresponding metadata information, and performs confidential identification on the metadata information to identify the sensitivity of the data corresponding to the development and release file, so as to manage data with different sensitivity levels. Compared with the existing manual judgment method, it has low cost and high efficiency. Compared with the existing method that needs to scan all data, it avoids the consumption of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention;

[0061] Figure 2 is a schematic flowchart of the first embodiment of the confidential information identification method of the present invention;

[0062] Figure 3 It is a schematic diagram of an abstract syntax tree in the first embodiment of the method for identifying confidential information of the present invention;

[0063] Figure 4 It is a schematic flowchart of the second embodiment of the method for identifying confidential information of the present invention.

[0064] The realization of the object, functional characteristics and advantages of the present invention will be further described with reference to the embodiments and the accompanying drawings. Detailed implementation manners

[0065] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0066] As Figure 1 shown, Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment solution of the present invention.

[0067] The terminal in the embodiment of the present invention can be a PC or a server device.

[0068] As Figure 1 shown, the terminal may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard). Optionally, the user interface 1003 may further include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the foregoing processor 1001.

[0069] Those skilled in the art can understand that Figure 1 the device structure shown in

[0070] As Figure 1 shown, the memory 1005, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a confidential information identification program.

[0071] Among them, the operating system is a program that manages and controls the confidential information identification device and software resources, and supports the operation of the network communication module, user interface module, confidential information identification program, and other programs or software; the network communication module is used to manage and control the network interface 1004; the user interface module is used to manage and control the user interface 1003.

[0072] In Figure 1 In the confidential information identification device shown, the confidential information identification device calls the confidential information identification program stored in the memory 1005 through the processor 1001, and executes the operations in each embodiment of the following confidential information identification method.

[0073] Based on the above hardware structure, an embodiment of the confidential information identification method of the present invention is proposed.

[0074] Referring to Figure 2 , Figure 2 is a schematic flowchart of the first embodiment of the confidential information identification method of the present invention, and the method includes:

[0075] Step S10, when a development and release file is detected, scan the script corresponding to the development and release file to obtain the DDL script corresponding to the development and release file;

[0076] Step S20, parse the DDL script to extract the metadata information corresponding to the DDL script;

[0077] Step S30, determine whether the metadata information matches the preset confidential information in the preset confidential information definition library;

[0078] Step S40, if it matches, label the metadata information as confidential information.

[0079] In this embodiment, in the process of metadata management in financial institutions such as banks, without reading the data content corresponding to the development and release file, by scanning the database script of the development and release file, the corresponding metadata information is extracted, and the metadata information is marked as confidential to identify the sensitivity of the data corresponding to the development and release file, so as to manage data with different sensitivity levels and improve the metadata security management of financial institutions such as banks.

[0080] The following will explain each step in detail:

[0081] Step S10, when a development and release file is detected, scan the script corresponding to the development and release file to obtain the DDL script corresponding to the development and release file.

[0082] The confidential information identification method of this embodiment is applied to the confidential information identification device of financial institutions such as wealth management institutions or banking systems. For the convenience of description, the confidential information identification device is hereinafter referred to as the identification device. Among them, the identification device is used to receive the development and release files and perform confidential identification on the data corresponding to the development and release files. Among them, the development and release files refer to the list of files that need to be released after development is completed.

[0083] When a development and release file is detected, scan the database script corresponding to the development and release file. Specifically, scan the database script corresponding to the development and release file in the corresponding release material library. From all the scripts, determine the DDL (Data Definition Language) script. It can be understood that since the file suffix and file attributes of the DDL script are different from those of other scripts, the DDL script can be determined from all the scripts according to the file suffix and file attributes.

[0084] Specifically, step S10 includes:

[0085] When a development and release file is detected, read the release package of the development and release file, and extract the corresponding sql script from the release package;

[0086] In this step, when a development and release file is detected, obtain the release package corresponding to the development and release file from the corresponding release material library, decompress the release package to obtain the corresponding decompressed file, and scan the decompressed file to extract the sql (Structured Query Language) script from it. Among them, the sql script is mainly extracted according to the file suffix and file attributes of the decompressed file. For example, the files with suffixes such as ".sql", ".hql", ".h", etc. in the decompressed file are sql scripts.

[0087] Identify the corresponding DDL script from the sql script.

[0088] In this step, by identifying the name of the parent directory of the sql script, it is confirmed whether the script is a DDL script. In this embodiment, the file directory name where the DDL script is located is uniformly named, such as the DDL file. Therefore, it can be confirmed whether the script is a DDL script by identifying the name of the parent directory where the sql script is located. Finally, the identified DDL script is marked and extracted.

[0089] It should be noted that the DDL script obtained in this embodiment is an incremental DDL script, that is, only the database script corresponding to the development and release file needs to be scanned, rather than all the database scripts in the release material library. In other words, only the newly added database scripts in the release material library need to be scanned.

[0090] Step S20: Parse the DDL script to extract the metadata information corresponding to the DDL script.

[0091] In this embodiment, after obtaining the DDL script corresponding to the development and release file, the DDL script is parsed to extract the metadata information corresponding to the DDL script. Among them, metadata information refers to data that describes data, specifically information that describes the meaning of fields in the metadata database. This information can assist data users in better understanding the data. It includes the Chinese name of the field, the English name of the field, and the field type, etc. The metadata information in this embodiment refers to the descriptive information of the data corresponding to the development and release file.

[0092] Specifically, step S20 includes:

[0093] Extract the sql string from the DDL script, and based on the sql string, parse the DDL script into a corresponding abstract syntax tree;

[0094] In this step, the identification device extracts the sql string from the DDL script and parses the DDL script into a corresponding abstract syntax tree based on the sql string. Specifically, the sql string can be input into the sql parser, and the abstract syntax tree corresponding to the DDL script can be obtained through the sql parser. Among them, the sql parser can be manually written or generated semi-automatically using tools in actual operations.

[0095] Extract the corresponding metadata information from the abstract syntax tree.

[0096] In this step, taking the Create statement as an example, the corresponding abstract syntax tree is as Figure 3 described. Therefore, TableName (table name), filedName (field name, including the Chinese name and English name of the field), filedtype (field type), and filedlength (field length) can be extracted from the abstract syntax tree. In this embodiment, the field name and field type are preferentially extracted, but it does not exclude applying other metadata information in the abstract syntax tree to this embodiment when necessary.

[0097] Step S30: Determine whether the metadata information matches the preset confidential information in the preset confidential information definition library.

[0098] In this embodiment, the metadata data information is compared with the preset confidential information in the preset confidential information definition library to determine whether the metadata information matches the preset confidential information in the preset confidential information definition library. Among them, in the identification device, there is a preset confidential information definition library, and in the preset confidential information definition library, various general metadata information marked as confidential information is stored. The preset confidential information definition library is updated in real time to ensure that all confidential information is covered as much as possible. In the process of determining whether the current metadata information matches the preset confidential information, the metadata information is compared one by one with the general metadata information in the preset confidential information. If they are the same, it is determined that the metadata information matches the preset confidential information; if they are different, it is determined that the metadata information does not match the preset confidential information. It can be understood that in the case where the similarity between the metadata information and the preset confidential information is relatively high, it can also be considered that the metadata information matches the preset confidential information. The algorithm for calculating the similarity between the metadata information and the preset confidential information can adopt the edit distance algorithm, or the cosine similarity algorithm. When using the cosine similarity algorithm, it is necessary to vectorize the string corresponding to the component data information and the preset confidential information. In addition, the Euclidean distance algorithm can also be used. The specific algorithm is not limited in this embodiment, and any algorithm that can calculate the similarity between the metadata information and the preset confidential information can be applied to this embodiment.

[0099] Step S40, if they match, mark the metadata information as confidential information.

[0100] In this embodiment, in the case of determining that the metadata information matches the preset confidential information, the metadata information is marked as confidential information to identify the sensitivity of the data corresponding to the development and release file, which is convenient for users to correctly manage the data corresponding to the current development and release file when managing the data.

[0101] Furthermore, in the process of marking the metadata information as confidential information, the matching degree, that is, the similarity, between the metadata information and the preset confidential information can be calculated, and the confidential level of the metadata information can be determined according to the calculated similarity.

[0102] Specifically, a similarity-confidential level mapping table can be preset. After calculating the similarity between the metadata information and the preset confidential information, according to the calculated similarity, the corresponding confidential level is determined in the similarity-confidential level mapping table. Finally, the metadata information is marked as the confidential information of the corresponding confidential level. For example, if the similarity between the metadata information and the preset confidential information is 100%, that is, exactly the same, and the corresponding confidential level in the similarity-confidential level mapping table is level one, then the metadata information is marked as the confidential information of level one; if the similarity between the metadata information and the preset confidential information is 80%, and the corresponding confidential level in the similarity-confidential level mapping table is level two, then the metadata information is marked as level two, etc.

[0103] Further, after step S40, it further includes:

[0104] Write the metadata information into a preset confidential information definition library, so as to add the Chinese field name, English field name, and field type in the metadata information into the corresponding general Chinese name, general English name, and general field type respectively, so as to obtain an updated confidential information definition library.

[0105] In this step, if it is determined that the metadata information matches the preset confidential information, the metadata information is marked as confidential information and written into the preset confidential information definition library to expand the preset confidential information definition library. Specifically, the Chinese field name, English field name, field type, etc. in the metadata information are added into the corresponding general Chinese name, general English name, and general field type respectively, so as to obtain an updated confidential information definition library. When a new development and release file is detected next time, the updated confidential information definition library is used as the reference object for comparison.

[0106] In this embodiment, when a development and release file is detected, scan the script corresponding to the development and release file to obtain the DDL script corresponding to the development and release file; parse the DDL script to extract the metadata information corresponding to the DDL script. Determine whether the metadata information matches the preset confidential information in the preset confidential information definition library; if it matches, mark the metadata information as confidential information. Without reading the data content, the present invention extracts the corresponding metadata information by scanning the database script corresponding to the development and release file, and performs confidential marking on the metadata information to identify the sensitivity of the data corresponding to the development and release file, so as to manage data with different sensitivities. Compared with the existing manual judgment method, it has low cost and high efficiency. Compared with the existing method that needs to scan all data, it avoids the consumption of computing resources and better meets the needs of financial institutions such as banks, with better economic benefits.

[0107] Further, based on the first embodiment of the confidential information marking method of the present invention, a second embodiment of the confidential information marking method of the present invention is proposed.

[0108] The difference between the second embodiment of the confidential information marking method and the first embodiment of the confidential information marking method is that, referring to Figure 4 , the metadata information includes a Chinese field name and an English field name, and step S30 includes:

[0109] Step S31, determine whether the Chinese field name is consistent with the general Chinese name in the preset confidential information. If it is consistent, determine that the metadata information matches the preset confidential information;

[0110] Step S32: If they are inconsistent, determine whether the English name of the field is consistent with the common English name in the preset confidential information. If they are consistent, determine that the metadata information matches the preset confidential information.

[0111] In this embodiment, when determining whether the metadata information matches the preset confidential information, as long as a certain element in the metadata information matches a certain element in the preset confidential information, it can be considered that the metadata information matches the preset confidential information, reducing the matching work and the complexity of the matching.

[0112] The following will explain each step:

[0113] Step S31: Determine whether the Chinese name of the field is consistent with the common Chinese name in the preset confidential information. If they are consistent, determine that the metadata information matches the preset confidential information.

[0114] In this embodiment, when determining whether the metadata information matches the preset confidential information, only the Chinese name of the field in the metadata information needs to be compared with the common Chinese name in the preset confidential information to determine whether the metadata information matches the preset confidential information. That is, if the Chinese name of the field is consistent with the common Chinese name, it means that the metadata information matches the preset confidential information; if the Chinese name of the field is inconsistent with the common Chinese name, it means that the metadata information does not match the preset confidential information.

[0115] It can be understood that there are several common Chinese names. As long as the current Chinese name of the field matches one of the common Chinese names, it can be considered that the Chinese name of the field is consistent with the common Chinese name. For example, if the Chinese name of the field in the current metadata information is customer name, and the common Chinese names include customer name, customer title, customer, and personal customer name, etc., it is determined that the current Chinese name of the field is consistent with the common Chinese name.

[0116] Step S32: If they are inconsistent, determine whether the English name of the field is consistent with the common English name in the preset confidential information. If they are consistent, determine that the metadata information matches the preset confidential information.

[0117] In this embodiment, if it is determined that the Chinese name of the field is inconsistent with the common Chinese name, further determine whether the English name of the field in the metadata information is consistent with the common English name in the preset confidential information. The judgment process is the same as the above judgment of the Chinese name of the field. If they are consistent, determine that the metadata information matches the preset confidential information. For example, if the current English name of the field is cust name, and the common English names include cust name, name, and personal name, etc., it is determined that the current English name of the field is consistent with the common English name.

[0118] It should be noted that in this embodiment, whether to first determine whether the Chinese name of the current field is the same as the general Chinese name or first determine whether the English name of the current field is the same as the general English name has no impact on the result. Therefore, step S32 can be executed first, and then step S31, that is, first determine whether the English name of the current field is the same as the general English name. If they are not the same, then determine whether the Chinese name of the current field is the same as the general Chinese name.

[0119] In addition, to improve the accuracy of confidential information identification, it is optional to determine whether the Chinese name of the field is the same as the general Chinese name in the preset confidential information; and whether the English name of the field is the same as the general English name in the preset confidential information;

[0120] Only when the Chinese name of the field is the same as the general Chinese name in the preset confidential information and the English name of the field is the same as the general English name in the preset confidential information, it is determined that the metadata information matches the preset confidential information. Further, the method further includes:

[0121] If they are not the same, calculate the first similarity between the Chinese name of the field and the general Chinese name;

[0122] In this step, if both the Chinese name and the English name of the current field are not the same as the general Chinese name and the general English name, the matching requirement is lowered. Based on a preset algorithm, calculate the first similarity between the Chinese name of the current field and the general Chinese name. Among them, the preset algorithm can specifically be the Levenshtein Distance algorithm. This algorithm refers to the minimum number of edit operations required to convert two strings from one to the other (edit operations include replacing one character with another, inserting a character, and deleting a character). The smaller the edit distance, the greater the similarity between the two strings. In this embodiment, according to the edit distance algorithm, calculate the minimum number of edit operations required to convert the Chinese name of the field into the general Chinese name, and then calculate the first similarity between the Chinese name of the field and the general Chinese name based on the minimum number of edit operations.

[0123] Of course, in specific implementation, other algorithms can also be used to calculate the similarity between the Chinese name of the field and the general Chinese name, such as the Cosine Similarity algorithm, the Euclidean Distance algorithm, etc. This embodiment does not limit this.

[0124] Determine whether the first similarity reaches a first threshold. If so, determine that the metadata information matches the preset confidential information;

[0125] In this step, compare the calculated first similarity with the first threshold to determine whether the first similarity reaches the first threshold, that is, the first similarity is greater than or equal to the first threshold. If so, it is determined that the metadata information matches the preset confidential information. In specific implementation, the first threshold is set to 50%, that is, when the first similarity reaches 50%, it is considered that the metadata information matches the preset confidential information.

[0126] If not, calculate the second similarity between the English name of the field and the general English name;

[0127] In this step, if the first similarity does not reach the first threshold, that is, the first similarity is less than the first threshold, then further calculate the second similarity between the English name of the current field and the general English name. The calculation method is similar to the above calculation of the first similarity between the Chinese name of the current field and the general Chinese name, and will not be elaborated here.

[0128] Determine whether the second similarity reaches the second threshold. If so, determine that the metadata information matches the preset confidential information

[0129] In this step, after calculating the second similarity, compare the first similarity with the second threshold to determine whether the second similarity reaches the second threshold. If so, determine that the metadata information matches the preset confidential information.

[0130] It should be noted that the first threshold is different from the second threshold. In specific implementation, the second threshold is set to 80%, that is, when the Chinese name of the current field does not match the general Chinese name, the similarity between the English name of the current field and the general English name needs to reach 80% to determine that the metadata information matches the preset confidential information.

[0131] In this embodiment, when determining whether the metadata information matches the preset confidential information, as long as a certain element in the metadata information matches a certain element in the preset confidential information, it can be considered that the metadata information matches the preset confidential information, reducing the matching work and the complexity of the matching.

[0132] Further, based on the first and second embodiments of the confidential information identification method of the present invention, a third embodiment of the confidential information identification method of the present invention is proposed.

[0133] The difference between the third embodiment of the confidential information identification method and the first and second embodiments of the confidential information identification method is that the metadata information further includes a field type, and the method further includes:

[0134] Step a, determine whether the field type is consistent with the general field type in the preset confidential information;

[0135] Step b, if they are consistent, determine that the metadata information matches the preset confidential information;

[0136] Step c, if they are inconsistent, send the metadata information to the manual judgment channel, and when receiving the confirmation information sent by the manual judgment channel based on the metadata information, determine that the metadata information matches the preset confidential information.

[0137] In this embodiment, the metadata information further includes a field type. In the process of determining whether the metadata information matches the preset confidential information, it is also necessary to determine whether the field type is consistent with the field type in the preset confidential information, so as to improve the accuracy of the matching.

[0138] The following will explain each step in detail:

[0139] Step a, determine whether the field type is consistent with the general field type in the preset confidential information.

[0140] In this embodiment, in the process of determining whether the metadata information matches the preset confidential information, the field type in the metadata information is further compared with the general field type in the preset confidential information to determine whether the current field type is consistent with the general field type. Taking the customer name as an example, its corresponding current field type is String, and the general field types include String and Varchar, etc., so the current field type is consistent with the general field type.

[0141] It should be noted that in the specific implementation of this step, it is only when it is determined that the field name (field Chinese name and field English name) matches the general field name (general Chinese name and general English name) that it is determined whether the current field type is consistent with the general field type. That is, in this embodiment, after it is determined that the field name matches the general field name, it is further determined whether the current field type is consistent with the general field type.

[0142] Step b, if they are consistent, determine that the metadata information matches the preset confidential information.

[0143] In this embodiment, if they are consistent, that is, the field name in the current metadata information matches the general field name in the preset confidential information, and the current field type is consistent with the general field type, then it is determined that the metadata information matches the preset confidential information.

[0144] It can be understood that in financial institutions such as banks, due to different business categories, when the same customer handles different businesses, the generated data is different. Although the data at this time all corresponds to the same customer, their actual business types are different.

[0145] Based on the above similar principle, when the field name in the current metadata information matches the general field name, there may also be a situation where the field types are inconsistent. Therefore, after determining that the field name matches the general field name, it is also necessary to determine whether the current field type is consistent with the general field type. If they are consistent, it is determined that the metadata information matches the preset confidential information.

[0146] Step c, if they are inconsistent, then send the metadata information to the manual judgment channel, and when receiving the confirmation information sent by the manual judgment channel based on the metadata information, determine that the metadata information matches the preset confidential information.

[0147] In this embodiment, if they are inconsistent, that is, the field name in the current metadata information matches the general field name in the preset confidential information, but the current field type is inconsistent with the general field type, then send the metadata information to the manual judgment channel, and let the corresponding judgment personnel make a judgment manually. If receiving the confirmation information sent by the manual judgment channel based on the current metadata information, determine that the metadata information matches the preset confidential information; if not receiving the confirmation information sent by the manual judgment channel based on the current metadata information, determine that the metadata information does not match the preset confidential information, or if receiving the veto information sent by the manual judgment channel based on the current metadata information, determine that the metadata information does not match the preset confidential information.

[0148] The metadata information in this embodiment also includes the field type. During the process of determining whether the metadata information matches the preset confidential information, it is also necessary to determine whether the field type is consistent with the field type in the preset confidential information to improve the accuracy of the matching.

[0149] The present invention also provides a confidential information identification device. The confidential information identification device of the present invention includes:

[0150] A scanning module, configured to scan the script corresponding to the development and release file when detecting the development and release file, so as to obtain the DDL script corresponding to the development and release file;

[0151] An analysis module, configured to analyze the DDL script to extract the metadata information corresponding to the DDL script;

[0152] A determination module, configured to determine whether the metadata information matches the preset confidential information in the preset confidential information library;

[0153] An identification module, configured to, if they match, identify the metadata information as confidential information.

[0154] Further, the scanning module is further configured to:

[0155] When a development release file is detected, read the release package of the development release file and extract the corresponding SQL script from the release package;

[0156] Identify the corresponding DDL script from the SQL script.

[0157] Preferably, the parsing module is further configured to:

[0158] Extract the SQL string from the DDL script and, based on the SQL string, parse the DDL script into a corresponding abstract syntax tree;

[0159] Extract the corresponding metadata information from the abstract syntax tree.

[0160] Further, the metadata information includes the Chinese name of the field and the English name of the field, and the determination module is further configured to:

[0161] Determine whether the Chinese name of the field is consistent with the common Chinese name in the preset confidential information. If it is consistent, determine that the metadata information matches the preset confidential information;

[0162] If it is not consistent, determine whether the English name of the field is consistent with the common English name in the preset confidential information. If it is consistent, determine that the metadata information matches the preset confidential information.

[0163] Further, the determination module is further configured to:

[0164] If it is not consistent, calculate the first similarity between the Chinese name of the field and the common Chinese name;

[0165] Determine whether the first similarity reaches a first threshold. If it does, determine that the metadata information matches the preset confidential information;

[0166] If not, calculate the second similarity between the English name of the field and the common English name;

[0167] Determine whether the second similarity reaches a second threshold. If it does, determine that the metadata information matches the preset confidential information.

[0168] Further, the determination module is further configured to:

[0169] Determine whether the field type is consistent with the common field type in the preset confidential information;

[0170] If it is consistent, determine that the metadata information matches the preset confidential information;

[0171] If they are inconsistent, the metadata information is sent to the manual judgment channel, and when the confirmation information sent by the manual judgment channel based on the metadata information is received, it is determined that the metadata information matches the preset confidential information.

[0172] Further, the device further includes an update module for:

[0173] Writing the metadata information into a preset confidential information definition library, so as to add the Chinese name, English name, and field type of the fields in the metadata information into the corresponding general Chinese name, general English name, and general field type respectively, so as to obtain an updated confidential information definition library.

[0174] The present invention also provides a computer-readable storage medium.

[0175] A confidential information identification program is stored on the computer-readable storage medium of the present invention. When the confidential information identification program is executed by a processor, the steps of the confidential information identification method described above are implemented.

[0176] Among them, the method implemented when the confidential information identification program running on the processor is executed can refer to each embodiment of the confidential information identification method of the present invention, which will not be elaborated here.

[0177] It should be noted that in this article, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or system. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or system including that element.

[0178] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments.

[0179] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that makes a contribution to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium as described above (such as ROM / RAM, magnetic disk, optical disc), and includes several instructions for causing a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0180] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, shall be equally included in the patent protection scope of the present invention.

Claims

1. A method for identifying confidential information, characterized in that, The method for identifying confidential information includes the following steps: When a development release file is detected, scan the script corresponding to the development release file to obtain the data definition language (DDL) script corresponding to the development release file; Parse the DDL script to extract the metadata information corresponding to the DDL script; Determine whether the metadata information matches the preset confidential information in the preset confidential information definition library; If there is a match, calculate the similarity between the metadata information and the preset confidential information. According to the calculated similarity, determine the corresponding confidential level in the preset similarity-confidential level mapping table, and label the metadata information as confidential information at the corresponding confidential level.

2. The confidential information identification method according to claim 1, wherein The step of, when a development release file is detected, scanning the script of the development release file to obtain the DDL script corresponding to the development release file includes: When a development release file is detected, read the release package of the development release file and extract the corresponding structured query language (SQL) script from the release package; Identify the corresponding DDL script from the SQL script.

3. The confidential information identification method according to claim 1, characterized in that, The step of parsing the DDL script to extract the metadata information corresponding to the DDL script includes: Extract the SQL string from the DDL script, and based on the SQL string, parse the DDL script into a corresponding abstract syntax tree; Extract the corresponding metadata information from the abstract syntax tree.

4. The confidential information identification method according to claim 1, characterized in that, The metadata information includes the Chinese name of the field and the English name of the field. The step of determining whether the metadata information matches the preset confidential information in the preset confidential information definition library includes: Determine whether the Chinese name of the field is the same as the general Chinese name in the preset confidential information. If they are the same, determine that the metadata information matches the preset confidential information; If they are not the same, determine whether the English name of the field is the same as the general English name in the preset confidential information. If they are the same, determine that the metadata information matches the preset confidential information.

5. The confidential information identification method according to claim 4, characterized in that After the step of determining whether the English name of the field is the same as the general English name, the method further includes: If they are not the same, calculate the first similarity between the Chinese name of the field and the general Chinese name; Determine whether the first similarity reaches a first threshold. If it does, determine that the metadata information matches the preset confidential information; If not, calculate the second similarity between the English name of the field and the general English name; Determine whether the second similarity reaches a second threshold. If it does, determine that the metadata information matches the preset confidential information.

6. The confidential information identification method according to claim 1, wherein The metadata information includes the field type. The step of determining that the metadata information matches the preset confidential information includes: Determine whether the field type is the same as the general field type in the preset confidential information; If they are the same, determine that the metadata information matches the preset confidential information; If they are inconsistent, send the metadata information to the manual judgment channel, and when receiving the confirmation information sent by the manual judgment channel based on the metadata information, determine that the metadata information matches the preset confidential information.

7. The confidential information identification method according to any one of claims 1-6, characterized in that After identifying the metadata information as confidential information with the corresponding confidential level, the method further includes: Writing the metadata information into a preset confidential information definition library, so as to add the Chinese name, English name, and field type of the fields in the metadata information into the corresponding general Chinese name, general English name, and general field type respectively, to obtain an updated confidential information definition library.

8. A confidential information identification device, characterized in that, The confidential information identification device includes: A scanning module, configured to scan the script corresponding to the development and release file when detecting the development and release file, so as to obtain the DDL script corresponding to the development and release file; An analysis module, configured to analyze the DDL script to extract the metadata information corresponding to the DDL script; A determination module, configured to determine whether the metadata information matches the preset confidential information in the preset confidential information definition library; An identification module, configured to, if they match, calculate the similarity between the metadata information and the preset confidential information, determine the corresponding confidential level in the preset similarity-confidential level mapping table according to the calculated similarity, and identify the metadata information as confidential information with the corresponding confidential level.

9. A confidential information identification device, characterized in that, The confidential information identification device includes: a memory, a processor, and a confidential information identification program stored on the memory and executable on the processor. When the confidential information identification program is executed by the processor, the steps of the confidential information identification method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores a confidential information identification program, and when the confidential information identification program is executed by a processor, the steps of the confidential information identification method according to any one of claims 1 to 7 are implemented.

Images