Sensitive information protection method, device, electronic device and readable storage medium

Abstract

The present invention relates to the field of computer information security technology, and in particular to a sensitive information protection method, device, electronic device and computer-readable storage medium. The method comprises: obtaining an information flow path of sensitive information; wherein the information flow path comprises at least two information nodes; determining a target information node according to the information flow path; performing dynamic obfuscation processing on the sensitive information at the target information node; and transmitting the sensitive information after the dynamic obfuscation processing to the next information node. The technical solution provided by the present application effectively improves the security of sensitive information from the active protection side.

Description

Technical Field

[0001] The present invention relates to the field of computer information security technology, and in particular to a sensitive information protection method, device, electronic device and readable storage medium. Background Art

[0002] As the application of the Internet continues to expand, there will be a lot of sensitive information on the Internet, such as user privacy, business secrets, etc. Therefore, the demand for Internet system security and interconnected sensitive information is also increasing, especially the Internet financial system has put forward higher requirements for the security of sensitive information. However, most of the current Internet financial systems basically protect sensitive information from a defensive perspective, that is, using methods such as firewalls, malware interception, and attack interception to prevent sensitive information from being leaked. With the continuous development of Internet technology, many systems are currently at risk of being detected for vulnerabilities, probed for structures, and analyzed for codes. Criminals often use simulated browsers or automated tools to attack network security. Once the attack is successful or the protection layer is destroyed, system information will be leaked. Summary of the invention

[0003] The purpose of this application is to solve at least one of the above technical defects. The technical solution adopted by this application is as follows:

[0004] In a first aspect, an embodiment of the present application discloses a sensitive information protection method, the method comprising:

[0005] Obtaining an information flow path of sensitive information; wherein the information flow path includes at least two information nodes;

[0006] Determine a target information node according to the information flow path;

[0007] Performing dynamic obfuscation processing on the sensitive information at the target information node;

[0008] The sensitive information after the dynamic obfuscation process is transmitted to the next information node.

[0009] Furthermore, the sensitive information includes, but is not limited to: user information, application signature information, key information, and encryption and decryption rules.

[0010] Furthermore, after dynamically obfuscating the sensitive information at the target information node, the method further includes:

[0011] Obtaining a random encryption factor from sensitive information;

[0012] The user information and application signature information are encrypted using the MD5 algorithm using the key information and the random encryption factor.

[0013] Furthermore, the sensitive information source includes but is not limited to: Cookies, form data, URL information. When the sensitive information is URL information, the dynamic obfuscation processing of the sensitive information at the target information node includes:

[0014] Obtain the response message of the application or browser to the user's request instruction;

[0015] Detect whether the URL of the response message belongs to a preset whitelist;

[0016] If not, the link and input form in the response message are obfuscated.

[0017] Furthermore, the target information nodes include: a sensitive information creation node, a sensitive information storage node, and a sensitive information transmission node.

[0018] Furthermore, before transmitting the sensitive information after dynamic obfuscation processing to the next information node, the method further includes:

[0019] Acquire the port information of the next information node; wherein the port information includes the service type and port transmission protocol corresponding to the port;

[0020] Determine whether the port is a security authorized port according to the port information;

[0021] If not, the sensitive information transmission process is stopped.

[0022] Furthermore, the method also includes: when receiving a user's request information for a URL, the system server sends a dynamic token for accessing the URL to the user; when the dynamic token input by the user received by the system is the same as the dynamic token sent by the server, an access interface for the user to the URL is created.

[0023] Furthermore, the method further comprises: obtaining unsafe information records of the system, wherein the unsafe information records include vulnerability information and attack records;

[0024] Determining a processing rule for performing protection processing on the sensitive information according to the unsafe information record;

[0025] The sensitive information that has passed the dynamic obfuscation algorithm is processed according to the processing rules.

[0026] Furthermore, the attacked records include but are not limited to: attack time, attacker network environment information, attacker fingerprint information, attacker behavior information; further, processing the sensitive information after the dynamic obfuscation algorithm according to the processing rules includes:

[0027] Analyze the attack records to draw a portrait of the attacker and the attack strategy;

[0028] A defense strategy that is opposite to the attack strategy and / or an attack strategy targeting the attacker's profile is formulated to process the sensitive information.

[0029] In a further embodiment, after transmitting the sensitive information after the dynamic obfuscation process to the next information node, the method further includes:

[0030] When receiving a query instruction from a user for the sensitive information, decrypting the sensitive information according to the MD5 algorithm to obtain the key information and the random encryption factor;

[0031] Decrypting according to the key information and the random encryption factor to obtain the sensitive information that has been dynamically obfuscated;

[0032] The obfuscated sensitive information is decrypted according to the dynamic obfuscation feature.

[0033] On the other hand, an embodiment of the present application provides a sensitive information protection device, the device comprising: a query module, a determination module, a processing module and a communication module, wherein:

[0034] The query module is used to obtain an information flow path of sensitive information; wherein the information flow path includes at least two information nodes;

[0035] The determination module is used to determine the target information node according to the information flow path;

[0036] The processing module is used to perform dynamic obfuscation processing on the sensitive information at the target information node;

[0037] The communication module is used to transmit the sensitive information after the dynamic obfuscation processing to the next information node.

[0038] Furthermore, the communication module is also used to receive a user's request information for a URL, and accept a dynamic token for accessing the URL sent by the system server to the user;

[0039] The communication module is also used to create an access interface for the user to the URL when the dynamic token input by the user and received by the system is the same as the dynamic token sent by the server.

[0040] Furthermore, the communication module is also used to obtain unsafe information records of the system, wherein the unsafe information records include vulnerability information and attack records;

[0041] The determination module is further used to determine a processing rule for performing protection processing on the sensitive information according to the unsafe information record;

[0042] The processing module is also used to process the sensitive information that has passed the dynamic obfuscation algorithm according to the processing rules.

[0043] In a third aspect, an embodiment of the present application provides an electronic device, including a processor and a memory;

[0044] The memory is used to store operation instructions;

[0045] The processor is used to execute the method described in any of the above embodiments by calling the operation instruction.

[0046] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any of the above embodiments is implemented.

[0047] The sensitive information protection scheme provided by the embodiment of the present application mainly includes obtaining an information flow path of sensitive information; wherein the information flow path includes at least two information nodes; determining a target information node according to the information flow path; performing dynamic obfuscation processing on the sensitive information at the target information node; and transmitting the sensitive information after the dynamic obfuscation processing to the next information node. The technical scheme provided by the embodiment of the present application has the beneficial effect of effectively improving the security of sensitive information from the active protection side. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in describing the embodiments of the present application.

[0049] Figure 1 A flowchart of a sensitive information protection method provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the structure of a sensitive information protection device provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present invention.

[0053] It should be noted that, within the scope that can be understood by technicians in this technical field, unless specifically stated, the singular forms "one", "an", "said" and "the" used here may also include plural forms, and the "first" and "second" etc. are only for the purpose of introducing the clear scheme to distinguish the object definition, and do not limit the object itself. Of course, the objects defined by "first" and "second" may be the same terminal, device and user, etc., or the same type of terminal, device and user. It should be further understood that the wording "including" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or their groups. The wording "and / or" used here includes all or any unit and all combinations of one or more associated listed items. In addition, it should be understood that in the embodiments of the present application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, a and b, a and c, b and c, or a, b and c, where a, b, c can be single or plural.

[0054] The sensitive information protection schemes in the prior art currently have the problem of poor flexibility as described in the background art. Based on this, the following embodiments of the present invention provide a sensitive information protection method to solve at least one of the above-mentioned defects.

[0055] In order to more clearly introduce the technical solution of the present application, some concepts, terms or devices that may be involved in the following embodiments are introduced below to help understand the sensitive information protection solution disclosed in the present application:

[0056] Obfuscation is a measure taken to protect the logic of the code from being understood by others when it is impossible to prevent others from obtaining the code. Obfuscated code is difficult for others to understand, modify, and reuse. Dynamic code obfuscation can be simply understood as infecting sensitive information with "different" obfuscated codes at each information flow node.

[0057] Dynamic obfuscation is an analysis method that runs the code in a controllable environment, monitors all code operations throughout the process, observes changes in its status and execution process, and obtains various data during the execution process. Common dynamic analysis methods include debugging, segmentation, tracing, simulators, etc. The advantage of a dynamic analysis framework over dynamic analysis is that it can track and observe the status of each step, thereby obtaining more information. However, dynamic analysis also has its own shortcomings, such as heavy reliance on program input, and a good test environment must be constructed to ensure that the code to be analyzed is executed correctly. In addition, many protected programs can detect that they are being debugged or running in a virtual machine, thereby activating defense mechanisms.

[0058] Figure 1 A schematic diagram of a sensitive information protection process provided by an embodiment of the present application is shown. Figure 1 As shown, the method may mainly include:

[0059] S101, obtaining a sensitive information flow path; wherein the information flow path includes at least two information nodes; further, the sensitive information includes but is not limited to: user information, application signature information, key information, encryption and decryption rules. The sensitive information source includes but is not limited to: Cookies, form data, URL information.

[0060] S102, determining a target information node according to the information flow path;

[0061] In a further optional embodiment, the target information nodes include: a sensitive information creation node, a sensitive information storage node, and a sensitive information transmission node.

[0062] S103, performing dynamic obfuscation processing on the sensitive information at the target information node;

[0063] In a specific embodiment, the system uses a dynamic obfuscation algorithm to encrypt terminal users' cookies, form data, URLs, etc., including various sensitive information such as user names and passwords. The field names and data in the submitted forms and the parameters in the URLs will all be dynamically obfuscated to ensure the security of user information.

[0064] After the sensitive information is dynamically obfuscated at the target information node, the obfuscated sensitive information may be further encrypted according to the type of sensitive information or higher requirements for the security of sensitive information to further improve the security of sensitive information transmission. In an optional embodiment, the following steps may be taken again for the sensitive information after the obfuscation process:

[0065] Step 1: Obtain a random encryption factor from sensitive information;

[0066] Step 2: Use the key information and the random encryption factor to perform MD5 algorithm encryption on the user information and the application signature information. Of course, in an optional embodiment, the encryption algorithm can be different according to the different sensitive information.

[0067] In one embodiment, when the sensitive information is URL information, the dynamically obfuscating the sensitive information at the target information node includes:

[0068] Step 1: Obtain the response message of the application or browser to the user's request instruction;

[0069] Step 2: Detect whether the URL of the response message belongs to a preset whitelist;

[0070] Step 3: If it does not belong to the above, the link and input form in the response message are obfuscated. If it does belong to the above, the transmission can be carried out directly.

[0071] In an optional embodiment, before transmitting the sensitive information after dynamic obfuscation processing to the next information node, the method further includes:

[0072] Acquire the port information of the next information node; wherein the port information includes the service type and port transmission protocol corresponding to the port;

[0073] Determine whether the port is a security authorized port according to the port information;

[0074] If not, the sensitive information transmission process is stopped.

[0075] S104: Transmit the sensitive information after the dynamic obfuscation processing to the next information node.

[0076] In a further embodiment, after the sensitive information after the dynamic obfuscation process is transmitted to the next information node, if the user needs to query the sensitive information, the encrypted and obfuscated sensitive information needs to be decrypted first. Based on the above embodiment, in an optional embodiment, the step of the user querying the sensitive information may include:

[0077] Step 1: when receiving a query instruction from a user for the sensitive information, decrypt the sensitive information according to the MD5 algorithm to obtain the key information and the random encryption factor;

[0078] Step 2: Decrypt the key information and the random encryption factor to obtain the sensitive information that has been dynamically obfuscated;

[0079] Step 3: Decrypt the obfuscated sensitive information according to the dynamic obfuscation feature.

[0080] In an embodiment of the present application, sensitive message data in the system is dynamically obfuscated to ensure that the request content containing sensitive information cannot be tampered with or forged, thereby ensuring data authenticity and transaction message integrity, while also improving the security of sensitive information.

[0081] In a further optional embodiment, the method further includes: when receiving a user's request information for a URL, the system server sends a dynamic token for accessing the URL to the user; when the system receives a dynamic token input by the user that is the same as the dynamic token sent by the server, an access interface for the user to access the URL is created. The dynamic token is a one-time "pass identification code" assigned to a URL address that the user can legally access. Each token attached to a user's request needs to be verified by the server, thereby preventing malicious behaviors such as illegal access and ensuring the correct execution of the original logical relationship of the business.

[0082] The sensitive information protection solution provided in the embodiment of the present application configures a dynamic verification code for each URL accessed to achieve defense against unauthorized access, web backdoors, replay attacks, application layer DDoS and other automated malicious attacks on business logic.

[0083] In a further optional embodiment, the method further includes:

[0084] Step 1. Obtain the unsafe information records of the system, wherein the unsafe information records include vulnerability information and attack records; in a further optional embodiment, the attack records include but are not limited to: attack time, attacker's network environment information (such as browser, plug-in, etc.), fingerprint information (such as browser fingerprint, IP, cookies, etc.), behavior information (such as mouse, keyboard operation) and other data, to profile the attacker, accurately describe the attacker's source, target, tools used, methods, and retain evidence and process data of the attack.

[0085] Step 2: determining a processing rule for protecting the sensitive information according to the unsafe information record; wherein the processing rule is a reverse processing determined according to the unsafe information record;

[0086] Step 3: Process the sensitive information that has passed the dynamic obfuscation algorithm according to the processing rules.

[0087] In a further embodiment, the attack record includes but is not limited to: attack time, attacker network environment information, attacker fingerprint information, attacker behavior information; further processing the sensitive information after the dynamic obfuscation algorithm according to the processing rules includes:

[0088] Analyze the attack records to draw a portrait of the attacker and the attack strategy;

[0089] A defense strategy that is opposite to the attack strategy and / or an attack strategy targeting the attacker's profile is formulated to process the sensitive information.

[0090] In order to further introduce the reprocessing of obfuscated sensitive information by analyzing attack records, we will take the analysis of IP information in attack records as an example. First, we can intercept the abnormally accessed IP and register it in the redis cache; then extract the IP address from each request and check in REDIS whether the current IP is the registered attack IP. If it is, we will issue an alarm or intercept it.

[0091] The sensitive information protection scheme disclosed in the embodiment of the present application effectively prevents the leakage of user sensitive data, and can also prevent crawlers to prevent data traversal. In addition, the introduction of dynamic tokens prevents request information from being tampered with, ensures the security of sensitive data, and avoids losses caused by related attacks.

[0092] based on Figure 1 The sensitive information protection method shown in the figure, on the other hand, the embodiment of the present application provides a sensitive information protection device, such as Figure 2 As shown, the device may include: a query module 201, a determination module 202, a processing module 203 and a communication module 204, wherein:

[0093] The query module 201 is used to obtain an information flow path of sensitive information; wherein the information flow path includes at least two information nodes;

[0094] The 202 determination module is used to determine the target information node according to the information flow path;

[0095] The 203 processing module is used to perform dynamic obfuscation processing on the sensitive information at the target information node;

[0096] The communication module 204 is used to transmit the sensitive information after the dynamic obfuscation process to the next information node.

[0097] In a further optional embodiment, the 202 determination module is further used to determine: a sensitive information creation node, a sensitive information storage node, and a sensitive information transmission node.

[0098] In a further optional embodiment, the communication module 204 is further used to receive a user's request information for a URL, and accept a dynamic token for accessing the URL sent by the system server to the user;

[0099] The communication module 204 is also used to create an access interface for the user to the URL when the dynamic token input by the user and received by the system is the same as the dynamic token sent by the server.

[0100] In a further embodiment, the communication module 204 is further used to obtain a random encryption factor from sensitive information; the processing module 203 performs MD5 algorithm encryption processing on the user information and application signature information using the key information and the random encryption factor.

[0101] In an optional embodiment, the device also includes a 205 detection module. When the sensitive information is URL information, the 204 communication module is also used to obtain a response message from an application or browser to a user request instruction; the detection module is used to detect whether the URL of the response message belongs to a preset whitelist; if not, the 203 processing module obfuscates the links and input forms in the response message.

[0102] In an optional embodiment, before transmitting the sensitive information after dynamic obfuscation processing to the next information node, the query module 201 is also used to obtain the port information of the next information node; wherein the port information includes the service type and port transmission protocol corresponding to the port; the detection module 205 is also used to determine whether the port is a security authorized port based on the port information; if not, the processing module 203 stops the sensitive information transmission process.

[0103] In an optional embodiment, the device further includes a decryption module 206. When the query module 201 receives a query instruction for the sensitive information from the user, the decryption module 206 decrypts the sensitive information according to the MD5 algorithm to obtain the key information and the random encryption factor. Further, the decryption module 206 decrypts the sensitive information after dynamic obfuscation according to the key information and the random encryption factor, and then decrypts the obfuscated sensitive information according to the dynamic obfuscation feature.

[0104] In a further optional embodiment, the communication module 204 is further used to obtain unsafe information records of the system, wherein the unsafe information records include vulnerability information and attack records;

[0105] The 202 determination module is further used to determine a processing rule for protecting the sensitive information according to the unsafe information record;

[0106] The 203 processing module is also used to process the sensitive information that has undergone the dynamic obfuscation algorithm according to the processing rules.

[0107] It can be understood that the above-mentioned components of the sensitive information protection device in this embodiment have the function of realizing Figure 1 The functions of the corresponding steps of the method in the embodiment shown in . The function can be implemented by hardware, or by hardware executing the corresponding software. The hardware or software includes one or more modules or devices corresponding to the above functions. The above modules and devices can be software and / or hardware, and the above modules and devices can be implemented separately or integrated with multiple modules and devices. For the functional description of the above modules and devices, please refer to Figure 1 The corresponding description of the method in the embodiment shown in , therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding method provided above, which will not be repeated here.

[0108] It is understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the sensitive information protection device. In other embodiments of the present application, the sensitive information protection device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0109] An embodiment of the present application provides an electronic device, including a processor and a memory;

[0110] A memory, used for storing operation instructions;

[0111] The processor is used to execute the sensitive information protection method provided in any embodiment of the present application by calling an operation instruction.

[0112] As an example, Figure 3 A schematic diagram of the structure of an electronic device applicable to the embodiment of the present application is shown. Figure 3 As shown, the electronic device 300 includes: a processor 301 and a memory 303. Among them, the processor 301 and the memory 303 are connected, such as being connected through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one. It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the electronic device 300. In other embodiments of the present application, the electronic device 300 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 305 for displaying images, or receiving user operation instructions when necessary.

[0113] The processor 301 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 304 may include a receiver and a transmitter. The transceiver 304 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0114] Processor 301 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0115] The processor 301 may also include one or more processing units, for example, the processor 301 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processor (NPU). Among them, different processing units may be independent devices or integrated into one or more processors. Among them, the controller may be the nerve center and command center of the electronic device 300. The controller may generate an operation control signal according to the instruction opcode and the timing signal to complete the control of fetching and executing instructions. A memory may also be set in the processor 301 for storing instructions and data. In some embodiments, the memory in the processor 301 is a high-speed cache memory. The memory may store instructions or data that the processor 301 has just used or circulated. If the processor 301 needs to use the instruction or data again, it may be directly called from the memory. Repeated access is avoided, the waiting time of the processor 301 is reduced, and the efficiency of the system is improved.

[0116] The processor 301 can run the sensitive information protection method provided in the embodiment of the present application to reduce the user's operation complexity, improve the intelligence of the terminal device, and enhance the user experience. The processor 301 can include different devices. For example, when the CPU and GPU are integrated, the CPU and GPU can cooperate to execute the sensitive information protection method provided in the embodiment of the present application. For example, part of the algorithm in the sensitive information protection method is executed by the CPU, and the other part of the algorithm is executed by the GPU to obtain faster processing efficiency.

[0117] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0118] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or may include a high-speed random access memory, or may include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0119] Optionally, the memory 303 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the sensitive information protection method provided in any embodiment of the present application.

[0120] The memory 303 can be used to store computer executable program codes, which include instructions. The processor 301 executes various functional applications and data processing of the electronic device 300 by running the instructions stored in the memory 303. The memory 303 may include a program storage area and a data storage area. Among them, the program storage area may store the code of the operating system, application program, etc. The data storage area may store data created during the use of the electronic device 300 (such as images, videos, etc. collected by the camera application), etc.

[0121] The memory 303 may also store one or more computer programs corresponding to the sensitive information protection method provided in the embodiments of the present application. The one or more computer programs are stored in the above-mentioned memory 303 and are configured to be executed by the one or more processors 301. The one or more computer programs include instructions, and the above-mentioned instructions can be used to execute each step in the above-mentioned corresponding embodiment.

[0122] Of course, the code of the sensitive information protection method provided in the embodiment of the present application can also be stored in an external memory. In this case, the processor 301 can run the code of the sensitive information protection method stored in the external memory through the external memory interface, and the processor 301 can control the operation of the sensitive information protection process.

[0123] The display screen 305 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 300 may include 1 or N display screens 305, where N is a positive integer greater than 1. The display screen 305 can be used to display information input by a user or information provided to a user and various graphical user interfaces (GUI). For example, the display screen 305 can display photos, videos, web pages, or files.

[0124] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0125] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the sensitive information protection method shown in the above method embodiment is implemented.

[0126] The computer-readable storage medium provided in the embodiment of the present application is applicable to any embodiment of the above-mentioned method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0127] The embodiment of the present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the above-mentioned related steps to implement the method in the above-mentioned embodiment. The computer program product provided in the embodiment of the present application is applicable to any embodiment of the above-mentioned method, and therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0128] The sensitive information protection scheme provided by the embodiment of the present application includes obtaining an information flow path of sensitive information; wherein the information flow path includes at least two information nodes; determining a target information node according to the information flow path; performing dynamic obfuscation processing on the sensitive information at the target information node; and transmitting the sensitive information after the dynamic obfuscation processing to the next information node. The technical scheme provided by the embodiment of the present application effectively improves the security of sensitive information from the active protection side.

[0129] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another device, or some features can be discarded or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0130] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0131] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0132] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0133] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0134] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, and can also make some improvements and modifications. These changes, substitutions, improvements and modifications should also be considered to be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A sensitive information protection method, characterized in that: The method comprises: Obtaining an information flow path of sensitive information; wherein the information flow path includes at least two information nodes; Determine a target information node according to the information flow path; Performing dynamic obfuscation processing on the sensitive information at the target information node; After the sensitive information is dynamically obfuscated at the target information node, the following steps are included: Obtaining a random encryption factor from sensitive information; Utilize key information and random encryption factors to encrypt user information and application signature information using the MD5 algorithm, and / or apply different encryption algorithms based on different sensitive information; When the sensitive information is URL information, the dynamically obfuscating the sensitive information at the target information node includes: Obtain the response message of the application or browser to the user's request instruction; Detect whether the URL of the response message belongs to a preset whitelist; If not, the link and input form in the response message are obfuscated; Transmit the sensitive information after dynamic obfuscation to the next information node; After the sensitive information is dynamically obfuscated at the target information node, the method further includes: performing other types of encryption processing on the obfuscated sensitive information according to the type of sensitive information or the security level of sensitive information to further improve the security of sensitive information transmission; Before transmitting the sensitive information after dynamic obfuscation processing to the next information node, the method further includes: Acquire the port information of the next information node; wherein the port information includes the service type and port transmission protocol corresponding to the port; Determine whether the port is a security authorized port according to the port information; If not, stopping the sensitive information transmission process; After transmitting the sensitive information after the dynamic obfuscation process to the next information node, the method further includes: When receiving a query instruction from a user for the sensitive information, decrypting the sensitive information according to the MD5 algorithm to obtain the key information and the random encryption factor; Decrypting according to the key information and the random encryption factor to obtain the sensitive information that has been dynamically obfuscated; Decrypting the obfuscated sensitive information according to the dynamic obfuscation feature; The target information node includes: Sensitive information creation node, sensitive information storage node, sensitive information transmission node.

2. The sensitive information protection method according to claim 1, characterized in that: The sensitive information includes but is not limited to: User information, application signature information, key information, encryption and decryption rules.

3. The sensitive information protection method according to claim 2, characterized in that: The sources of sensitive information include but are not limited to: Cookies, form data, URL information.

4. The sensitive information protection method according to claim 1, characterized in that: The method further comprises: When receiving a request for a URL from a user, the system server sends a dynamic token for accessing the URL to the user; When the dynamic token input by the user and received by the system is the same as the dynamic token sent by the server, an access interface for the user to the URL is created.

5. The sensitive information protection method according to claim 1, characterized in that: The method further comprises: Obtaining unsafe information records of the system, wherein the unsafe information records include vulnerability information and attack records; Determining a processing rule for performing protection processing on the sensitive information according to the unsafe information record; The sensitive information that has been dynamically obfuscated is processed according to the processing rules.

6. The sensitive information protection method according to claim 5, characterized in that: The attack records include but are not limited to: attack time, attacker network environment information, attacker fingerprint information, and attacker behavior information; Further processing the sensitive information after dynamic obfuscation processing according to the processing rules includes: Analyze the attacked records to draw a portrait of the attacker and the attack strategy; A defense strategy that is opposite to the attack strategy and / or an attack strategy targeting the attacker's profile is formulated to process the sensitive information.

7. A sensitive information protection device, characterized in that: The device comprises: a query module, a determination module, a processing module and a communication module, wherein: The query module is used to obtain an information flow path of sensitive information; wherein the information flow path includes at least two information nodes; The determination module is used to determine the target information node according to the information flow path, and the target information node includes: a sensitive information creation node, a sensitive information storage node, and a sensitive information transmission node; The processing module is used to perform dynamic obfuscation processing on the sensitive information at the target information node; After the sensitive information is dynamically obfuscated at the target information node, the processing module is further used to: obtain a random encryption factor from the sensitive information; Utilize key information and random encryption factors to encrypt user information and application signature information using the MD5 algorithm, and / or apply different encryption algorithms based on different sensitive information; When the sensitive information is URL information, the dynamically obfuscating the sensitive information at the target information node includes: Obtain the response message of the application or browser to the user's request instruction; Detect whether the URL of the response message belongs to a preset whitelist; If not, the link and input form in the response message are obfuscated; The communication module is used to transmit the sensitive information after dynamic obfuscation processing to the next information node; The communication module further includes, before transmitting the sensitive information after dynamic obfuscation processing to the next information node: obtaining the port information of the next information node; wherein the port information includes the service type and port transmission protocol corresponding to the port; Determine whether the port is a security authorized port according to the port information; If not, stopping the sensitive information transmission process; The processing module is also used for, after the sensitive information is dynamically obfuscated at the target information node, performing other types of encryption processing on the obfuscated sensitive information again according to the type of sensitive information or the security level of sensitive information to further improve the security of sensitive information transmission; After transmitting the sensitive information after the dynamic obfuscation processing to the next information node, the device further includes: When receiving a query instruction from a user for the sensitive information, decrypting the sensitive information according to the MD5 algorithm to obtain the key information and the random encryption factor; Decrypting according to the key information and the random encryption factor to obtain the sensitive information that has been dynamically obfuscated; The obfuscated sensitive information is decrypted according to the dynamic obfuscation feature.

8. The sensitive information protection device according to claim 7, characterized in that: The communication module is also used to receive the user's request information for the URL, and accept the dynamic token for accessing the URL sent by the system server to the user; The communication module is also used to create an access interface for the user to the URL when the dynamic token input by the user and received by the system is the same as the dynamic token sent by the server.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store operation instructions; The processor is used to execute the method according to any one of claims 1 to 6 by calling the operation instruction.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images