Data security processing method, device, equipment and storage medium

Abstract

The present invention relates to the field of Internet technology, and discloses a data security processing method, device, equipment and storage medium, wherein the method comprises: obtaining multiple metadata in a business system and the field length corresponding to each metadata, and classifying the metadata according to the field length corresponding to each metadata, obtaining multiple metadata sets, obtaining the data security level corresponding to each metadata set, and searching for data desensitization rules according to the data security level, and desensitizing all metadata in the metadata set corresponding to the data security level according to the data desensitization rules, so as to obtain multiple target security data. Compared with the prior art, it is necessary to actively protect the data, but this will reduce the processing efficiency of the data, and in the present invention, the data desensitization rules are determined according to the data security level corresponding to the metadata, so that the metadata is desensitized according to the data desensitization rules, so as to achieve while ensuring data security, thereby improving the processing efficiency of the metadata.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a data security processing method, device, equipment and storage medium. Background Art

[0002] The information data of an enterprise is an intangible asset, and leakage will lead to loss of profits. Enterprises generally do some data security control, such as using disk arrays, data backup, and remote disaster recovery to ensure data security, but they still cannot stop data leakage. In the process of carrying out enterprise data security work, the most common disposal method is to use modern cryptographic algorithms to actively protect data, such as data confidentiality, data integrity, and two-way strong identity authentication. However, the biggest disadvantage is that it depends on the initiative of personnel to actively and consciously encrypt. This will result in lower data security and reduce the efficiency of data security processing.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a data security processing method, device, equipment and storage medium, aiming to solve the technical problem of how to improve the security of data and thereby improve the efficiency of data security processing.

[0005] To achieve the above object, the present invention provides a data security processing method, the data security processing method comprising:

[0006] Acquire multiple metadata in the business system and the field length corresponding to each metadata, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets;

[0007] Obtain the data security level corresponding to each metadata set, and search for data desensitization rules based on the data security level;

[0008] All metadata in the metadata set corresponding to the data security level are desensitized according to the data desensitization rule to obtain multiple target security data.

[0009] Optionally, the step of obtaining multiple metadata in the business system and the field length corresponding to each metadata includes:

[0010] Obtain multiple encrypted data in the business system and the field type corresponding to each encrypted data;

[0011] According to the field type, searching the mapping table for the decryption algorithm corresponding to each encrypted data;

[0012] Decrypt each encrypted data according to the decryption algorithm to obtain multiple metadata and the field length corresponding to each metadata.

[0013] Optionally, the step of classifying the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets includes:

[0014] Acquire the data connection relationship between each metadata, and form a data lineage analysis diagram for all metadata according to the data connection relationship;

[0015] Extract sensitive data contained in each metadata;

[0016] Each metadata is classified according to the sensitive data, the field length and the data lineage analysis diagram to obtain multiple metadata sets.

[0017] Optionally, the step of extracting sensitive data contained in each metadata includes:

[0018] Input each metadata into a preset sensitivity recognition model respectively to obtain a sensitivity recognition degree corresponding to each metadata and a sensitivity recognition type corresponding to the sensitivity recognition degree;

[0019] The sensitive data corresponding to each metadata is determined according to the sensitivity recognition degree and the sensitivity recognition type.

[0020] Optionally, after the step of performing desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain a plurality of target security data, the method further includes:

[0021] Rendering all target security data according to the data lineage analysis diagram to obtain a sensitive data distribution diagram;

[0022] Counting the total amount of all target security data, and determining a preset division rule according to the total amount of target security data;

[0023] Segmenting the sensitive data distribution map according to the preset segmentation rule to obtain a plurality of sensitive area distribution maps;

[0024] Perform data security risk assessment on each target security data in the sensitive area distribution map respectively.

[0025] Optionally, the step of performing data security risk assessment on each target security data in the sensitive area distribution map comprises:

[0026] Obtain the security level warning color corresponding to each sensitive area distribution map respectively;

[0027] When the safety level warning color is a preset high-risk warning color, obtaining a target sensitive area distribution map corresponding to the preset high-risk warning color;

[0028] Inputting the target sensitive area distribution map into a preset sensitivity analysis model to obtain a sensitive data proportion value corresponding to the target sensitive area distribution map;

[0029] Determine that the sensitive data ratio is greater than or equal to a preset sensitive data ratio threshold;

[0030] When the sensitive data proportion value is greater than or equal to the preset sensitive data proportion threshold, the target security data contained in the target sensitive area distribution map is obtained, and data security analysis and evaluation is performed on each target security data.

[0031] Optionally, after the step of performing data security analysis and evaluation on each target security data, the step further includes:

[0032] Input each target security data into the preset data security risk assessment model respectively to obtain the data security risk assessment value corresponding to each target security data;

[0033] Determining whether the data security risk assessment value is greater than or equal to a preset risk assessment threshold;

[0034] When the data security risk assessment value is greater than or equal to the preset risk assessment threshold, the target security data is destroyed.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also provides a data security processing device, the data security processing device comprising:

[0036] The acquisition module is used to acquire multiple metadata in the business system and the field length corresponding to each metadata, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets;

[0037] A search module is used to obtain the data security level corresponding to each metadata set and search for data desensitization rules according to the data security level;

[0038] A processing module is used to perform desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain multiple target security data.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also proposes a data security processing device, which includes: a memory, a processor, and a data security processing program stored in the memory and executable on the processor, and the data security processing program is configured to implement the steps of the data security processing method described above.

[0040] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a data security processing program is stored, and when the data security processing program is executed by a processor, the steps of the data security processing method described above are implemented.

[0041] The present invention first obtains multiple metadata in the business system and the field length corresponding to each metadata, and classifies the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets, and then obtains the data security level corresponding to each metadata set, and searches for data desensitization rules according to the data security level, and finally desensitizes all metadata in the metadata set corresponding to the data security level according to the data desensitization rules to obtain multiple target security data. Compared with the prior art, it is necessary to actively protect the data, but this will reduce the data processing efficiency. In the present invention, the data desensitization rules are determined according to the data security level corresponding to the metadata, so that the metadata is desensitized according to the data desensitization rules, which ensures data security while improving the metadata processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a structural diagram of a data security processing device in a hardware operating environment involved in an embodiment of the present invention;

[0043] Figure 2 This is a flow chart of a first embodiment of a data security processing method of the present invention;

[0044] Figure 3 This is a flow chart of a second embodiment of the data security processing method of the present invention;

[0045] Figure 4 It is a structural block diagram of the first embodiment of the data security processing device of the present invention.

[0046] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] Reference Figure 1 , Figure 1 It is a schematic diagram of the structure of a data security processing device in a hardware operating environment involved in an embodiment of the present invention.

[0049] like Figure 1As shown, the data security processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0050] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the data security processing device, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0051] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module and a data security processing program.

[0052] exist Figure 1 In the data security processing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the data security processing device of the present invention can be set in the data security processing device, and the data security processing device calls the data security processing program stored in the memory 1005 through the processor 1001, and executes the data security processing method provided by the embodiment of the present invention.

[0053] The embodiment of the present invention provides a data security processing method, referring to Figure 2 , Figure 2 Schematic diagram of the flow of the first embodiment of the data security processing method of the present invention.

[0054] In this embodiment, the data security processing method includes the following steps:

[0055] Step S10: Acquire multiple metadata in the business system and the field length corresponding to each metadata, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets.

[0056] It is easy to understand that the execution subject of this embodiment can be a data security processing device with functions such as data processing, network communication and program running, or other computer devices with similar functions, and this embodiment is not limited. In this embodiment, the data security processing device can be a central integrated system that can receive metadata and classify and desensitize the metadata.

[0057] It is understandable that the business system may be a third-party system, and the multiple metadata in the business system may be text or numbers, etc., which need to be sent to the central integration system.

[0058] The field length corresponding to each metadata can be understood as the character length corresponding to a text or number. Assuming that a text corresponds to two characters and a number corresponds to one character, the character length of "Zhang San" is 4, and the character length of "69870808998" is 11.

[0059] In a specific implementation, metadata is classified according to the field length corresponding to each metadata, and the step of obtaining multiple metadata sets can be understood as follows: the field length corresponding to each metadata may be the same or different. The central integration system will group metadata with consistent field lengths into a group as a metadata set. It can also be understood that, assuming that there are name sets and ID sets in the central integration system, the field length corresponding to the metadata in the name set can be 4-8, the field length corresponding to the metadata in the ID set can be 10-20, etc., the field length corresponding to each metadata is obtained, and the metadata with a field length of 4-8 is grouped as a name set, and the metadata with a field length of 10-20 is grouped as an ID set, etc.

[0060] Furthermore, before the step of obtaining multiple metadata in the business system and the field length corresponding to each metadata, it is also necessary to obtain multiple encrypted data in the business system and the field type corresponding to each encrypted data, and then find the corresponding decryption algorithm from the mapping relationship table according to the field type, and decrypt each encrypted data according to the decryption algorithm to obtain multiple metadata and the field length corresponding to each metadata.

[0061] Among them, the field type corresponding to the encrypted data can be a text type or a digital type, etc. There are multiple types and corresponding decryption algorithms for each type in the mapping relationship table. The decryption algorithm can be a low-level decryption algorithm or a high-level decryption algorithm, etc. Assuming that the type is a text type, the decryption algorithm corresponding to the text type is a low-level decryption algorithm. Assuming that the type is a digital type, the decryption algorithm corresponding to the digital type is a high-level decryption algorithm, etc. This embodiment does not limit this.

[0062] It is also necessary to understand that, assuming that the field length corresponding to each decrypted metadata is 0, it is determined that the metadata corresponding to the field length of 0 does not meet the storage conditions of the central integration system, and the metadata corresponding to the field length of 0 needs to be automatically blocked.

[0063] Furthermore, the metadata is classified according to the field length corresponding to each metadata. The step of obtaining multiple metadata sets can also be understood as obtaining the data connection relationship between the metadata, and forming a data lineage analysis diagram for all metadata according to the data connection relationship, extracting the sensitive data contained in each metadata, and classifying each metadata according to the sensitive data, field length and data lineage analysis diagram to obtain multiple metadata sets. Among them, the central integration system can also set corresponding encryption keys for multiple metadata sets. When new metadata is obtained, before the metadata is added to the corresponding metadata set, decryption authorization is required according to the decryption key corresponding to the encryption key.

[0064] The data connection relationship is the correspondence between metadata and metadata. It can be understood that a name and a corresponding ID number have a data connection relationship, etc. The data lineage analysis diagram connects the metadata with a connection relationship with straight lines or curves, thereby forming a logical connection diagram that can clearly observe the data.

[0065] Sensitive data can be customized by the user. The first letter of all words can be used as sensitive data, or the first digit of all numbers can be used as sensitive data, etc. This embodiment does not limit this.

[0066] In the specific implementation, each metadata is classified according to sensitive data, field length and data lineage analysis diagram to obtain the steps of multiple metadata sets. This can be understood as observing the data connection relationship between each metadata according to the data lineage analysis diagram, and then obtaining the field length corresponding to each metadata according to the data connection relationship, classifying each metadata according to the field length, and then determining each initial metadata set. Finally, the metadata in the initial metadata set is checked through sensitive data to determine whether the classification is correct. When the classification is correct, the initial metadata set is used as the metadata set.

[0067] Step S20: Obtain the data security level corresponding to each metadata set, and search for data desensitization rules according to the data security level.

[0068] The data security level can be customized by the user, which can be low data security level or high data security level, etc. The data desensitization rules can also be customized by the user, which can be random text desensitization or half digital desensitization, etc. This embodiment does not limit this.

[0069] Assuming that the metadata set is a name set, the data security level corresponding to the name set can be found from the mapping relationship table, where the data security level corresponding to the name set can be a low data security level, and the data desensitization rules corresponding to the low data security level are found in the mapping relationship table. In the mapping relationship table, the data security level and the data desensitization rules are in a one-to-one correspondence.

[0070] In a specific implementation, the step of obtaining the data security level corresponding to each metadata set can be to randomly select multiple metadata from the metadata set, and input the multiple metadata into a preset security level model to obtain security level values ​​corresponding to the multiple metadata, determine whether the security level value is within a preset low-level threshold range or a preset high-level threshold range, determine the data security level corresponding to the metadata based on the judgment result, and use the data security level corresponding to the metadata as the data security level corresponding to the metadata set.

[0071] The preset low-level threshold range and the preset high-level threshold range can be user-defined. The preset low-level threshold range can be 0-60%, and the preset high-level threshold range can be 61-100%, etc. This embodiment does not limit this.

[0072] The preset security level model can be obtained by inputting multiple sample metadata and the standard security level values ​​corresponding to the sample metadata into any of the following machine learning methods for training: support vector machine (SVM), logistic regression algorithm, decision tree, convolutional neural network, Bayesian method, etc., which is not limited in this embodiment.

[0073] Assume that multiple metadata are randomly selected from the metadata set, and the multiple metadata are input into the preset security level model to obtain a security level value of 40% corresponding to the multiple metadata, and determine that the security level value 40% is within the preset low-level threshold range of 0-60%. The data security level corresponding to the metadata is low data security, and the low data security level corresponding to the metadata is used as the data security level corresponding to the metadata set, and the data desensitization rules corresponding to the low data security level are obtained.

[0074] Step S30: Desensitizing all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain multiple target security data.

[0075] Among them, the target security data is the desensitized metadata.

[0076] Suppose the security data level corresponding to the metadata set is low-level security data, and the data desensitization rule corresponding to low-level security data is first-character desensitization. Then, all the metadata in the metadata set are subjected to first-character desensitization, and the desensitized metadata is used as the target security data. That is to say, suppose the metadata corresponding to the metadata set are "Zhang San", "Li Si", and "Wang Er" respectively, and the security data level corresponding to the metadata set is low-level security data. When the data desensitization rule corresponding to low-level security data is first-character desensitization, "Zhang San", "Li Si", and "Wang Er" are subjected to first-character desensitization to obtain the target security data such as "* San", "* Si", and "* Er", etc. This embodiment does not impose any restrictions.

[0077] Further, after the step of desensitizing all the metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain multiple target security data, the data bloodline analysis graph can be used to perform rendering processing on all the target security data to obtain a sensitive data distribution graph, count the total number of all the target security data, and determine a preset partitioning rule according to the total number of target security data. Then, the sensitive data distribution graph is segmented according to the preset partitioning rule to obtain multiple sensitive area distribution graphs, and data security risk assessment is performed on each target security data in the sensitive area distribution graphs respectively.

[0078] Among them, the step of performing rendering processing on all the target security data according to the data bloodline analysis graph to obtain a sensitive data distribution graph can be understood as follows: there are multiple target security data in the data bloodline analysis graph, and then color rendering is performed on the multiple target security data to give a security data reminder. The color rendering can be yellow rendering or red rendering, etc. Then, the graph after color rendering is used as the sensitive data distribution graph.

[0079] The total number of target security data is the total number of desensitized metadata, which can be 600 or 700, etc. This embodiment does not impose any restrictions.

[0080] The preset partitioning rule can be user-defined. It can be an average partitioning according to the total number of metadata, or a random area partitioning according to the bloodline analysis graph and the total number of metadata. Suppose the total number of target metadata in the sensitive data distribution graph is 600, then 600 can be divided into 3 sensitive area distribution graphs, with 200 in each. Then, data security risk assessment is performed on the 200 target security data in the sensitive area distribution graphs respectively.

[0081] The steps of performing data security risk assessment on each target security data in the sensitive area distribution map respectively can be to obtain the security level warning color corresponding to each sensitive area distribution map respectively, and when the security level warning color is a preset high-risk warning color, obtain the target sensitive area distribution map corresponding to the preset high-risk warning color, input the target sensitive area distribution map into the preset sensitive analysis model to obtain the sensitive data proportion value corresponding to the target sensitive area distribution map, judge whether the sensitive data proportion value is greater than or equal to the preset sensitive data proportion threshold value, and when the sensitive data proportion value is greater than or equal to the preset sensitive data proportion threshold value, obtain the target security data contained in the target sensitive area distribution map, and perform data security analysis and assessment on the target security data.

[0082] The safety level warning color and the preset high-risk warning color can be customized by the user, and can be red, blue, etc., and this embodiment is not limited thereto.

[0083] Assuming that the target security data in each sensitive area distribution map has a corresponding color identification, where the color identification can be the same or different, all colors in the target sensitive area distribution map are fused to obtain the target data warning color, and the target data warning color is used as the security level warning color. If the security level warning color is red and the preset high-risk warning color is red, then the target sensitive area distribution map corresponding to the security level warning color is input into the preset sensitive analysis model to obtain the corresponding sensitive data proportion value in the target sensitive area distribution map. Assuming that the sensitive data proportion value is 80%, the preset sensitive data proportion value is 70%, and the sensitive data proportion value is greater than the preset sensitive data proportion threshold, then all target security data in the target sensitive area distribution map are obtained, and data security analysis and evaluation are performed on the target security data.

[0084] Furthermore, after the step of performing data security analysis and evaluation on each target security data, each target security data needs to be input into a preset data security risk assessment model respectively to obtain a data security risk assessment value corresponding to each target security data, and determine whether the data security risk assessment value is greater than or equal to a preset risk assessment threshold. When the data security risk assessment value is greater than or equal to the preset risk assessment threshold, the target security data is destroyed.

[0085] The preset data security risk assessment model is constructed by training a convolutional neural network with multiple sample security data and standard security risk assessment values ​​corresponding to each sample security data, wherein the preset risk assessment threshold is a user-defined setting, which can be 70%, 80%, etc., and this embodiment is not limited to this.

[0086] Assuming that the data security risk assessment value corresponding to the target security data is 80%, the preset risk assessment threshold is 70%, and the data security risk assessment value is greater than the preset risk assessment threshold, the target security data will be destroyed.

[0087] In this embodiment, firstly, multiple metadata in the business system and the field length corresponding to each metadata are obtained, and the metadata are classified according to the field length corresponding to each metadata to obtain multiple metadata sets, and then the data security level corresponding to each metadata set is obtained, and the data desensitization rules are searched according to the data security level, and finally all metadata in the metadata set corresponding to the data security level are desensitized according to the data desensitization rules to obtain multiple target security data. Compared with the prior art, it is necessary to actively protect the data, but this will reduce the data processing efficiency. In this embodiment, the data desensitization rules are determined according to the data security level corresponding to the metadata, so that the metadata is desensitized according to the data desensitization rules, which ensures data security while improving the metadata processing efficiency.

[0088] refer to Figure 3 , Figure 3 Schematic diagram of the flow of the second embodiment of the data security processing method of the present invention.

[0089] Based on the above first embodiment, in this embodiment, step S10 further includes:

[0090] Step S101: Acquire multiple metadata in the business system and the field length corresponding to each metadata, acquire the data connection relationship between the metadata, and construct a data lineage analysis diagram for all metadata according to the data connection relationship.

[0091] It is understandable that the business system may be a third-party system, and the multiple metadata in the business system may be text or numbers, etc., which need to be sent to the central integration system.

[0092] The field length corresponding to each metadata can be understood as the character length corresponding to a text or number. Assuming that a text corresponds to two characters and a number corresponds to one character, the character length of "Zhang San" is 4, and the character length of "69870808998" is 11.

[0093] The data connection relationship can be understood as a connection relationship between metadata and metadata, for example, a connection relationship exists between a name and an ID number corresponding to the name, etc., and this embodiment does not limit this.

[0094] In the specific implementation, in order to facilitate the observation of the logical relationship between metadata and metadata, the data connection relationship between the metadata can be obtained, wherein a connection relationship may exist between multiple metadata and corresponding metadata. The metadata with a connection relationship can then be connected by a straight line or curve, and the connected metadata and the connection line can then form a data lineage analysis diagram.

[0095] Step S102: extracting sensitive data contained in each metadata.

[0096] It is understandable that the step of extracting the sensitive data contained in each metadata can be to input each metadata into a preset sensitive identification model respectively to obtain the sensitivity recognition degree corresponding to each metadata and the sensitive identification type corresponding to the sensitivity recognition degree, and determine the sensitive data corresponding to each metadata according to the sensitivity recognition degree and the sensitive identification type.

[0097] The preset sensitive identification model is a sensitive identification model constructed by inputting multiple sample metadata and corresponding standard sensitive identification types into a neural network model for training. The sensitive identification type can be a text type or a digital type, etc., which is not limited in this implementation.

[0098] Assume that a certain metadata is input into a preset sensitive recognition model, and the sensitivity recognition degree corresponding to the metadata is 80%, and its sensitivity recognition type is output as a text type, the preset sensitivity recognition degree is 70%, and the sensitivity recognition degree corresponding to the metadata is greater than the preset sensitivity recognition degree. Then, the sensitivity recognition type - text type is used as the sensitive recognition type of the metadata, and the corresponding sensitive rule is searched from the sensitive mapping relationship table according to the sensitive recognition type, and the sensitive data of the metadata is determined according to the sensitive rule, wherein the sensitive rule can be a user-defined setting, such as a text type, the corresponding sensitive rule is the first word of the metadata, a number type, the corresponding sensitive rule can be the last value of the metadata, etc., and this embodiment is not limited to this.

[0099] Step S103: Classify each metadata according to the sensitive data, the field length and the data lineage analysis diagram to obtain multiple metadata sets.

[0100] In the specific implementation, each metadata is classified according to sensitive data, field length and data lineage analysis diagram to obtain the steps of multiple metadata sets. This can be understood as observing the data connection relationship between each metadata according to the data lineage analysis diagram, and then obtaining the field length corresponding to each metadata according to the data connection relationship, classifying each metadata according to the field length, and then determining each initial metadata set. Finally, the metadata in the initial metadata set is checked through sensitive data to determine whether the classification is correct. When the classification is correct, the initial metadata set is used as the metadata set.

[0101] In this embodiment, the data connection relationship between each metadata is first obtained, and all metadata are constructed into a data lineage analysis diagram according to the data connection relationship. Then, the sensitive data contained in each metadata is extracted, and each metadata is classified according to the sensitive data, field length and data lineage analysis diagram to obtain multiple metadata data sets. In the prior art, users are required to actively classify when inputting metadata, but this will reduce the classification efficiency of metadata. In this embodiment, each metadata is classified according to sensitive data, field length and data lineage analysis diagram, thereby improving the classification efficiency of metadata while ensuring the accuracy of metadata classification.

[0102] Reference Figure 4 , Figure 4 It is a structural block diagram of the first embodiment of the data security processing device of the present invention.

[0103] like Figure 4 As shown, the data security processing device proposed in the embodiment of the present invention includes:

[0104] The acquisition module 4001 is used to acquire multiple metadata and the field length corresponding to each metadata in the business system, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets;

[0105] Search module 4002, used to obtain the data security level corresponding to each metadata set, and search for data desensitization rules according to the data security level;

[0106] The processing module 4003 is used to perform desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain multiple target security data.

[0107] In this embodiment, firstly, multiple metadata in the business system and the field length corresponding to each metadata are obtained, and the metadata are classified according to the field length corresponding to each metadata to obtain multiple metadata sets, and then the data security level corresponding to each metadata set is obtained, and the data desensitization rules are searched according to the data security level, and finally all metadata in the metadata set corresponding to the data security level are desensitized according to the data desensitization rules to obtain multiple target security data. Compared with the prior art, it is necessary to actively protect the data, but this will reduce the data processing efficiency. In this embodiment, the data desensitization rules are determined according to the data security level corresponding to the metadata, so that the metadata is desensitized according to the data desensitization rules, which ensures data security while improving the metadata processing efficiency.

[0108] Furthermore, the acquisition module 4001 is also used to acquire multiple encrypted data in the business system and the field type corresponding to each encrypted data;

[0109] The acquisition module 4001 is further used to search the decryption algorithm corresponding to each encrypted data from the mapping relationship table according to the field type;

[0110] The acquisition module 4001 is further used to decrypt each encrypted data according to the decryption algorithm to obtain multiple metadata and the field length corresponding to each metadata.

[0111] Furthermore, the acquisition module 4001 is also used to acquire the data connection relationship between each metadata, and form a data lineage analysis diagram for all metadata according to the data connection relationship;

[0112] The acquisition module 4001 is also used to extract sensitive data contained in each metadata;

[0113] The acquisition module 4001 is also used to classify each metadata according to the sensitive data, the field length and the data lineage analysis diagram to obtain multiple metadata sets.

[0114] Furthermore, the acquisition module 4001 is further used to input each metadata into a preset sensitivity recognition model to obtain the sensitivity recognition degree corresponding to each metadata and the sensitivity recognition type corresponding to the sensitivity recognition degree;

[0115] The acquisition module 4001 is further used to determine the sensitive data corresponding to each metadata according to the sensitivity recognition degree and the sensitivity recognition type.

[0116] Furthermore, the processing module 4003 is also used to render all target security data according to the data lineage analysis diagram to obtain a sensitive data distribution diagram;

[0117] The processing module 4003 is further used to count the total amount of all target security data and determine a preset division rule according to the total amount of target security data;

[0118] The processing module 4003 is further used to segment the sensitive data distribution map according to the preset segmentation rule to obtain multiple sensitive area distribution maps;

[0119] The processing module 4003 is also used to perform data security risk assessment on each target security data in the sensitive area distribution map.

[0120] Furthermore, the processing module 4003 is also used to obtain the security level warning color corresponding to each sensitive area distribution map;

[0121] The processing module 4003 is further configured to obtain a target sensitive area distribution map corresponding to the preset high-risk warning color when the safety level warning color is the preset high-risk warning color;

[0122] The processing module 4003 is further used to input the target sensitive area distribution map into a preset sensitivity analysis model to obtain a sensitive data proportion value corresponding to the target sensitive area distribution map;

[0123] The processing module 4003 is further used to determine whether the sensitive data ratio is greater than or equal to a preset sensitive data ratio threshold;

[0124] The processing module 4003 is also used to obtain the target security data included in the target sensitive area distribution map when the sensitive data proportion value is greater than or equal to the preset sensitive data proportion threshold, and perform data security analysis and evaluation on each target security data.

[0125] Furthermore, the processing module 4003 is also used to input each target security data into a preset data security risk assessment model to obtain a data security risk assessment value corresponding to each target security data;

[0126] The processing module 4003 is further used to determine whether the data security risk assessment value is greater than or equal to a preset risk assessment threshold;

[0127] The processing module 4003 is further configured to destroy the target security data when the data security risk assessment value is greater than or equal to the preset risk assessment threshold.

[0128] Other embodiments or specific implementations of the data security processing device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0129] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0130] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0131] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0132] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data security processing method, characterized in that: The data security processing method comprises: Acquire multiple metadata in the business system and the field length corresponding to each metadata, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets; Obtain the data security level corresponding to each metadata set, and search for data desensitization rules based on the data security level; Desensitizing all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain multiple target security data; The step of classifying the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets includes: Acquire the data connection relationship between each metadata, and form a data lineage analysis diagram for all metadata according to the data connection relationship; Input each metadata into a preset sensitivity recognition model respectively to obtain a sensitivity recognition degree corresponding to each metadata and a sensitivity recognition type corresponding to the sensitivity recognition degree; Determine the sensitive data corresponding to each metadata according to the sensitivity recognition degree and the sensitive recognition type; Classifying each metadata according to the sensitive data, the field length and the data lineage analysis diagram to obtain multiple metadata sets; After the step of performing desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain a plurality of target security data, the method further includes: Rendering all target security data according to the data lineage analysis diagram to obtain a sensitive data distribution diagram; Counting the total amount of all target security data, and determining a preset division rule according to the total amount of target security data; Segmenting the sensitive data distribution map according to the preset segmentation rule to obtain a plurality of sensitive area distribution maps; Perform data security risk assessment on each target security data in the sensitive area distribution map respectively.

2. The method according to claim 1, characterized in that The step of obtaining multiple metadata in the business system and the field length corresponding to each metadata includes: Obtain multiple encrypted data in the business system and the field type corresponding to each encrypted data; According to the field type, searching the mapping table for the decryption algorithm corresponding to each encrypted data; Decrypt each encrypted data according to the decryption algorithm to obtain multiple metadata and the field length corresponding to each metadata.

3. The method according to claim 1, characterized in that The step of performing data security risk assessment on each target security data in the sensitive area distribution map comprises: Obtain the security level warning color corresponding to each sensitive area distribution map respectively; When the safety level warning color is a preset high-risk warning color, obtaining a target sensitive area distribution map corresponding to the preset high-risk warning color; Inputting the target sensitive area distribution map into a preset sensitivity analysis model to obtain a sensitive data proportion value corresponding to the target sensitive area distribution map; Determine that the sensitive data ratio is greater than or equal to a preset sensitive data ratio threshold; When the sensitive data proportion value is greater than or equal to the preset sensitive data proportion threshold, the target security data contained in the target sensitive area distribution map is obtained, and data security analysis and evaluation is performed on each target security data.

4. The method according to claim 3, characterized in that After the step of performing data security analysis and evaluation on each target security data, the method further includes: Input each target security data into the preset data security risk assessment model respectively to obtain the data security risk assessment value corresponding to each target security data; Determining whether the data security risk assessment value is greater than or equal to a preset risk assessment threshold; When the data security risk assessment value is greater than or equal to the preset risk assessment threshold, the target security data is destroyed.

5. A data security processing device, characterized in that: The data security processing includes: The acquisition module is used to acquire multiple metadata and the field length corresponding to each metadata in the business system, and classify the metadata according to the field length corresponding to each metadata to obtain multiple metadata sets; A search module is used to obtain the data security level corresponding to each metadata set and search for data desensitization rules according to the data security level; A processing module, configured to perform desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule, so as to obtain a plurality of target security data; The operation of classifying metadata according to the field length corresponding to each metadata to obtain multiple metadata sets includes: Acquire the data connection relationship between each metadata, and form a data lineage analysis diagram for all metadata according to the data connection relationship; Input each metadata into a preset sensitivity recognition model respectively to obtain a sensitivity recognition degree corresponding to each metadata and a sensitivity recognition type corresponding to the sensitivity recognition degree; Determine the sensitive data corresponding to each metadata according to the sensitivity recognition degree and the sensitive recognition type; Classifying each metadata according to the sensitive data, the field length and the data lineage analysis diagram to obtain multiple metadata sets; After the operation of performing desensitization processing on all metadata in the metadata set corresponding to the data security level according to the data desensitization rule to obtain a plurality of target security data, the method further includes: Rendering all target security data according to the data lineage analysis diagram to obtain a sensitive data distribution diagram; Counting the total amount of all target security data, and determining a preset division rule according to the total amount of target security data; Segmenting the sensitive data distribution map according to the preset segmentation rule to obtain a plurality of sensitive area distribution maps; Perform data security risk assessment on each target security data in the sensitive area distribution map respectively.

6. A data security processing device, characterized in that: The data security processing device comprises: a memory, a processor, and a data security processing program stored in the memory and executable on the processor. When the data security processing program is executed by the processor, the steps of the data security processing method according to any one of claims 1 to 4 are implemented.

7. A storage medium, characterized in that: The storage medium stores a data security processing program, and when the data security processing program is executed by the processor, the steps of the data security processing method according to any one of claims 1 to 4 are implemented.

Images