A data desensitization processing method, device and storage medium

Abstract

This specification relates to the field of artificial intelligence technology, and specifically discloses a data desensitization processing method, device and storage medium, the method comprising: receiving a data access request sent by a client, the data access request including a specified user identity and a database access statement; parsing the database access statement to obtain database configuration information of a target information item; the database configuration information at least includes a target database, a database table and an information item identifier of the target information item where the target information item is located; retrieving a desensitization policy based on the database configuration information of the target information item and the specified user identity to desensitize data under the target information item extracted from the target database; and feeding back the desensitized data of the target information item to the client as response data to the data access request, thereby improving the flexibility of data desensitization processing.

Description

Technical Field

[0001] This specification relates to the field of artificial intelligence technology, and in particular, to a data desensitization processing method, device and storage medium. Background Art

[0002] In the data sharing process, data security and sensitivity are crucial issues. Data desensitization involves reshaping sensitive information using desensitization rules to reliably protect sensitive and private data. Currently, data desensitization methods primarily involve desensitizing sensitive data from production environments and storing it on target media. Other environments then access the data on the target media to perform business processing. However, desensitizing data to the target media effectively alters the content of the source data. Accessing the target media from other environments only allows access to the desensitized data, and the original data cannot be viewed. Summary of the Invention

[0003] The purpose of the embodiments of this specification is to provide a data desensitization processing method, device and storage medium, which can further improve the flexibility of data desensitization processing and make the desensitized data more in line with actual application needs.

[0004] This specification provides a data desensitization processing method, device and storage medium that are implemented in the following ways:

[0005] A data desensitization processing method is applied to a server, wherein the server is configured with at least one desensitization policy for an information item, wherein the desensitization policy refers to a method of performing desensitization processing on the data of the information item; the desensitization policy is at least associated with a user identity identifier; the method comprises: receiving a data access request sent by a client, wherein the data access request comprises a specified user identity identifier and a database access statement; parsing the database access statement to obtain database configuration information of a target information item; the database configuration information comprises at least a target database, a database table and an information item identifier of the target information item where the target information item is located; calling the desensitization policy according to the database configuration information of the target information item and the specified user identity identifier to perform desensitization processing on the data under the target information item extracted from the target database; and feeding back the desensitized data of the target information item to the client as response data to the data access request.

[0006] In some other embodiments of the method provided in this specification, the desensitization strategy at least includes a desensitization processing method configured based on a desensitization algorithm and not performing desensitization processing.

[0007] In some other embodiments of the method provided in this specification, the method further includes: when the database access statement includes more than two target information items, determining whether there is an information item group among the two or more target information items; the information items in the information item group are associated with a specified desensitization strategy when they are accessed together.

[0008] In some other embodiments of the method provided in this specification, calling the desensitization policy based on the database configuration information of the target information item and the designated user identity identifier includes: when there is an information item group in the two or more target information items, using the corresponding information item group as the target information item group; calling the desensitization policy based on the database configuration information of each target information item in the target information item group and the designated user identity identifier to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database.

[0009] In other embodiments of the method provided in this specification, for other target information items in the database access statement except the information item group, the desensitization strategy is called according to the database configuration information of the target information item and the specified user identity identifier to desensitize the data under the corresponding target information item extracted from the target database.

[0010] In some other embodiments of the method provided in this specification, the desensitization policy is at least associated with a business application type identifier; accordingly, the data access request also includes a specified business application type identifier.

[0011] In some other embodiments of the method provided in this specification, the method further includes: retrieving a desensitization policy according to the database configuration information of the target information item, the specified user identity identifier, and the specified business application type identifier.

[0012] In some other embodiments of the method provided in this specification, the method further includes: receiving data of the target information item extracted from the target database based on the database access statement; and correspondingly, performing desensitizing processing on the data of the target information item extracted from the target database based on the retrieved desensitizing strategy.

[0013] In some other embodiments of the method provided in this specification, the method further includes: rewriting the database access statement based on the retrieved desensitizing strategy, accessing the target database based on the rewritten database access statement, and extracting the desensitized data of the target information item; and receiving the desensitized data of the target information item fed back by the target database.

[0014] In some other embodiments of the method provided in this specification, the user identity identifier includes at least a user level identifier; and the desensitization strategy is constructed based on at least the level identifier in the user identity identifier.

[0015] On the other hand, an embodiment of the present specification also provides a data desensitizing processing device, which is applied to a server, wherein the server is configured with at least one desensitizing policy for an information item, wherein the desensitizing policy refers to a method of performing desensitizing processing on the data of the information item; the desensitizing policy is at least associated with a user identity identifier; the device includes: a request receiving module, for receiving a data access request sent by a client, wherein the data access request includes a specified user identity identifier and a database access statement; a parsing module, for parsing the database access statement to obtain database configuration information of the target information item; the database configuration information includes at least the target database, database table and information item identifier of the target information item where the target information item is located; a calling module, for calling the desensitizing policy according to the database configuration information of the target information item and the specified user identity identifier, so as to perform desensitizing processing on the data under the target information item extracted from the target database; a feedback module, for feeding back the desensitized data of the target information item as response data to the data access request to the client.

[0016] In some other embodiments of the device provided in this specification, the device also includes: a judgment module, which is used to judge whether there is an information item group among the two or more target information items when the database access statement includes more than two target information items; the information items in the information item group are associated with a specified desensitization strategy when they are accessed together.

[0017] In some other embodiments of the device provided in this specification, the retrieval module is also used to, when there is an information item group in the two or more target information items, use the corresponding information item group as the target information item group; and retrieve the desensitization policy based on the database configuration information of each target information item in the target information item group and the designated user identity identifier to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database.

[0018] In some other embodiments of the device provided in this specification, the calling module is also used to call the desensitization policy for other target information items in the database access statement except the information item group, according to the database configuration information of the target information item and the specified user identity identifier, so as to desensitize the data under the corresponding target information item extracted from the target database.

[0019] On the other hand, an embodiment of this specification further provides a computer-readable storage medium having computer instructions stored thereon, which, when executed, implement the steps of the method described in any one or more of the above embodiments.

[0020] The data desensitization processing method, device, and storage medium provided in one or more embodiments of this specification can make the positioning of information items more accurate and comprehensive by pre-sorting out information items layer by layer based on databases, database tables, and information item identifiers. Desensitization processing is then configured for each information item based on user identity and business application type, making the desensitization policy configuration more consistent with the needs of actual application scenarios, improving the flexibility of data desensitization processing, and making the desensitized data more consistent with actual application needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some of the embodiments described in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without inventive work. In the drawings:

[0022] Figure 1 This is a diagram of the desensitization strategy configuration provided in this manual;

[0023] Figure 2 A flowchart of an embodiment of a data desensitization processing method provided in this specification;

[0024] Figure 3 This is a schematic diagram of the module structure of a data desensitization processing device provided in this manual. DETAILED DESCRIPTION

[0025] In order to help those skilled in the art better understand the technical solutions in this specification, the following will clearly and completely describe the technical solutions in one or more embodiments of this specification in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of the specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the embodiments of this specification.

[0026] In an example application scenario of this specification, the data desensitization processing method can be applied to a database server that performs database access operations or a designated server that specifically performs data desensitization processing.

[0027] A desensitization strategy can be pre-configured. The desensitization strategy refers to the method of performing desensitization processing on the data of an information item. The information item can refer to a field in a database table, such as a user name, ID number, transaction amount, etc.

[0028] like Figure 1 As shown, the information in the database can be sorted out in the following ways.

[0029] 1) Database management: Configure the database type, connection information, etc.

[0030] 2) Table information management: Based on the database connection information, read the table information involved in each database and each information item in the table.

[0031] The field names in different tables may be the same. For example, a student information table may contain fields such as username and ID number. A product transaction details table may also contain fields such as username and ID number. However, the desensitization method configured for each field may vary across different databases and tables within those databases.

[0032] Information items can be located by combining information such as the database and database table where they are located, as well as their identifiers, to more accurately organize and configure desensitization strategies for different information items. For ease of description, the above information item location method can be described as the database configuration information of the information item.

[0033] Accordingly, the database configuration information may include at least the database, database table, and information item identifier of the information item. The database where the information item resides can be configured using database connection information. The database table where the information item resides can be configured using the table name. The information item identifier can be configured using, for example, a field name.

[0034] like Figure 1 As shown, user information and business application scenario information can also be sorted out.

[0035] 3) Obtain user identity information. Alternatively, create user groups to manage users based on business needs.

[0036] The user identity information may be for users in different business systems or users at different business levels. Business levels may be, for example, ordinary employees, business managers, etc. The user identity may then be identified using the business system identifier, or the business level identifier, to obtain a user identity identifier. Accordingly, the user identity identifier is information that identifies the user identity.

[0037] Alternatively, you can create user groups to manage users based on business needs. For example, you can create a user group for business personnel, a user group for operations and maintenance personnel, and a user group for outsourced developers. Within a user group, you can further divide it into more detailed sub-user groups based on business level, such as a general business personnel user group and a business manager user group. Then, you can use the user group ID to identify the users within that user group and serve as the user identity for each user within that user group.

[0038] 4) Get the business application type.

[0039] Business application types can include business software development, business software testing, and business data analysis. Business application type identifiers can be used to identify business application types. Different business application types have different data requirements, so different desensitization policies can be configured for each type.

[0040] By further configuring the desensitization policy according to the business application type, the desensitization processing can be made more in line with the actual application scenario and more targeted.

[0041] like Figure 1 As shown, desensitization strategies are configured for different information items. The desensitization strategies may include at least a desensitization processing mode configured based on a desensitization algorithm, not performing desensitization processing, and the like.

[0042] 5) Desensitization strategy.

[0043] (1) Desensitization algorithms. These include hash desensitization, masking desensitization, replacement desensitization, transformation desensitization, encryption desensitization, data decryption, and shuffling desensitization.

[0044] (2) Based on the existing desensitization algorithm, different desensitization processing methods are formulated. The desensitization processing method may be, for example, which desensitization algorithm is used to process which parts of the data.

[0045] For example, for a mobile phone number, desensitization algorithm A can be used to hide all of the phone number data, assuming the desensitized result is "XXXXXXXXXXX." Alternatively, desensitization algorithm A can be used to process part of the phone number data, resulting in a desensitized result of "150XXXXXXXX." Alternatively, desensitization algorithm B can be used to change the phone number to a randomly generated number sequence, and so on. Of course, the desensitization method described above can also be to not perform desensitization.

[0046] Data under a single information item can be processed using different desensitization methods for users with different identities. For example, desensitization may not be required for users of this business system. However, desensitization is required for users of other business systems. Different desensitization algorithms can also be used for users of different business systems. Accordingly, each desensitization policy under any information item can be associated with at least one user identity.

[0047] Alternatively, the data under a single information item can be processed using different desensitization methods for different business application types. For example, for business software development, desensitization algorithm A can be used to desensitize the data under that information item. For business data analysis, desensitization algorithm B can be used to desensitize the data under that information item. Accordingly, each desensitization strategy under any information item can be associated with at least one business application type identifier.

[0048] Of course, the desensitization policy can also be configured based on the user identity and business application type. Accordingly, each desensitization policy under any information item can be associated with at least the user identity identifier and the business application type identifier.

[0049] For information items that are not sensitive data, there may be several information items that are accessed together, making the information item sensitive data. Alternatively, there may be several information items that are accessed together, and a separate desensitization processing method needs to be set, and the desensitization processing method is different from the desensitization processing method used when any one of the information items is accessed alone. Accordingly, an information item group can be configured, and the information items in the information item group are associated with a specified desensitization policy when they are accessed together. Each desensitization policy under the information item group can be associated with a user identity identifier, or with a business application type identifier, or can also be associated with a user identity identifier and a business application type identifier. When the information item group is accessed together, the desensitization policy corresponding to the information item group can be used to perform desensitization processing on the data of any information item under the information item group.

[0050] By performing desensitization processing based on information item groups, the desensitization processing can be made more accurate and flexible, and the desensitized data can be more in line with the needs of business scenarios.

[0051] After the above desensitization policy is configured, it can be stored in the server or in a database that can be directly accessed by the server.

[0052] Inspired by the technical essence of the embodiments of this specification, technical personnel in the relevant field may have other changes in the implementation of the desensitization strategy configuration, but as long as the functions and effects achieved are the same or similar, they should be covered within the scope of protection of this specification.

[0053] In one example scenario, a desensitization operation program can be configured in a database server. The database server can receive data access requests sent by a client, access the database based on the data access requests, perform desensitization on the data read from the database based on a pre-configured desensitization policy, and feed the desensitized data back to the client.

[0054] The data access request may include, for example, a specified user identity and a database access statement. Alternatively, the data access request may include a specified business application type identifier and a database access statement. Alternatively, the data access request may further include a specified user identity, a specified business application type identifier, and a database access statement.

[0055] The database access statement may be an SQL statement for accessing a database to obtain the required data. The database server may parse the database access statement to determine database configuration information for the target information item to be accessed. The database configuration information may include at least the target database and database table where the target information item is located, and an information item identifier for the target information item.

[0056] The database access statement may also include data requirement information. This data requirement information may include, for example, data under specified conditions for querying the target information item. The specified conditions may include, for example, a specified time interval, a specified value range, etc. The data requirement information may also include extracting data after performing a specified operation on the data under the target information item, such as extracting the sum of the data under the target information item within a specified time period. Of course, the above data requirement information is merely illustrative, and the specific data requirement information is configured based on the application scenario and is not limited here.

[0057] The database server can access the target database based on the database configuration information and data requirement information of the target information item in the database access statement to extract the required data. Correspondingly, the database server can receive the data of the target information item extracted from the target database based on the database access statement.

[0058] The database server may also retrieve a desensitization policy based on the database configuration information of the target information item, the designated user identity identifier and / or the designated application type identifier.

[0059] For example, when the database access statement includes more than two target information items, the database server may determine whether an information item group exists among the two or more target information items.

[0060] If so, the corresponding information item group is used as the target information item group, and the desensitization policy is called according to the database configuration information of each target information item in the target information item group, the specified user identity identifier and / or the specified application type identifier, so as to perform desensitization processing on the data under each target information item in the target information item group extracted from the target database.

[0061] For other target information items except the information item group in the database access statement, the database server can call the desensitization strategy based on the database configuration information of the target information item, the specified user identity identifier and / or the specified application type identifier to desensitize the data under the target information item extracted from the target database.

[0062] Alternatively, if there is no information item group in the database access statement, the desensitization strategy is called according to the database configuration information of any target information item in the database access statement, the specified user identity identifier and / or the specified application type identifier to desensitize the data under the target information item extracted from the target database.

[0063] Correspondingly, after receiving the data fed back by the target database, the database server can perform desensitization processing on the data of any target information item extracted from the target database based on the retrieved desensitization strategy to obtain desensitized data.

[0064] The database server may also feed back the desensitized data as response data to the data access request to the client, so that the client can display it or perform other processing.

[0065] In another example scenario, the desensitization processing operation program can be configured in a designated server. The designated server can be a server that specifically performs desensitization processing. The designated server can receive data access requests sent by the client and send the data access requests to the database server.

[0066] The database server may access the database based on the data access request and feed back the data of the target information item extracted from the target database to the designated server.

[0067] The designated server may receive data of the target information item extracted from the target database based on the database access statement, and perform desensitization processing on the data of the target information item extracted from the target database based on a pre-configured desensitization policy. Furthermore, the designated server may feed back the desensitized data to the client.

[0068] Among them, the method of specifying the server to perform desensitization processing can refer to the method of the database server performing desensitization processing in the above scenario example, which will not be repeated here.

[0069] In another example scenario, a desensitization processing program can be configured in a designated server. The designated server can receive a data access request sent by a client, parse the data access request, retrieve a desensitization policy for the target information item based on the database configuration information, the designated user identity, and / or the designated application type identifier based on the parsed result, and rewrite the database access statement in the data access request based on the retrieved desensitization policy.

[0070] The designated server may send the rewritten database access statement to the database server, so that the database server accesses the target database based on the rewritten database access statement and extracts the desensitized data of the target information item.

[0071] Accordingly, the database server accesses the target database based on the rewritten database access statement and extracts the desensitized data of the target information item. The data obtained is the desensitized data, thereby desensitizing the data under the target information item extracted from the target database. The database server can feed the desensitized data back to the designated server.

[0072] The designated server then feeds the desensitized data back to the client as response data to the data access request.

[0073] Inspired by the technical essence of the embodiments of this specification, technical personnel in the relevant field may have other variations in the implementation of the desensitization process, but as long as the functions and effects achieved are the same or similar, they should be covered within the scope of protection of this specification.

[0074] In the above scenario, by pre-organizing information items layer by layer based on databases, database tables, and information item identifiers, the location of information items can be more accurate and comprehensive. Then, by configuring desensitization for each information item based on user identity and business application type, the desensitization policy configuration can be more accurately tailored to the actual application scenario, increasing the flexibility of data desensitization and ensuring that the desensitized data is more in line with actual application needs.

[0075] Based on the above scenario example, this specification also provides a data desensitization processing method. Figure 2 As shown, Figure 2It is a flow chart of an embodiment of the data desensitization processing method provided in this specification. Although this specification provides the method operation steps or device structures as shown in the following embodiments or drawings, more or fewer operation steps or module units after partial merger may be included in the method or device based on routine or no creative labor. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied to an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, a parallel processor or multi-threaded processing environment, or even an implementation environment including distributed processing and server clusters).

[0076] like Figure 2 As shown, in one embodiment of the data desensitization processing method provided in this specification, the method can be applied to a server. The server can be a database server that performs database access operations or a designated server that specifically performs data desensitization processing. The server is configured with at least one desensitization policy for an information item, and the desensitization policy refers to a method for performing desensitization processing on the data of the information item; the desensitization policy is at least associated with a user identity identifier. The method may include the following steps:

[0077] S20: Receive a data access request sent by a client, where the data access request includes a specified user identity and a database access statement;

[0078] S22: Parsing the database access statement to obtain database configuration information of the target information item; the database configuration information at least includes the target database where the target information item is located, the database table, and the information item identifier of the target information item;

[0079] S24: Retrieving a desensitization policy according to the database configuration information of the target information item and the designated user identity identifier to perform desensitization processing on the data under the target information item extracted from the target database;

[0080] S26: Feedback the desensitized data of the target information item to the client as response data of the data access request.

[0081] By pre-organizing information items layer by layer based on databases, database tables, and information item identifiers, the location of information items can be made more accurate and comprehensive. Then, desensitizing each information item based on user identity can be configured to better meet the needs of actual application scenarios, increase the flexibility of data desensitization, and make the desensitized data more suitable for actual application needs.

[0082] In some embodiments, the desensitization strategy includes at least a desensitization processing method configured based on the desensitization algorithm and no desensitization processing. By further configuring the desensitization processing method based on the desensitization algorithm, the desensitization strategy can be made more flexible and diverse, making the desensitized data more in line with the needs of actual application scenarios.

[0083] In some other embodiments, the user identity identifier includes at least a user level identifier; and the desensitization policy is constructed based on at least the level identifier in the user identity identifier. By further combining the user level identifier with the desensitization policy configuration, the desensitization policy configuration can be made more targeted, further improving the flexibility of data desensitization processing.

[0084] In some other embodiments, the desensitization policy is at least associated with a business application type identifier; accordingly, the data access request also includes a specified business application type identifier. Accordingly, the server can also retrieve the desensitization policy based on the database configuration information of the target information item, the specified user identity identifier, and the specified business application type identifier. By further configuring the desensitization policy in combination with the business application type, the desensitization policy configuration can be made more consistent with actual application scenarios.

[0085] In other embodiments, the server may also determine whether there is an information item group among the two or more target information items when the database access statement includes two or more target information items; the information items in the information item group are associated with a specified desensitization policy when they are accessed together.

[0086] Correspondingly, when an information item group exists in more than two target information items, the server can use the corresponding information item group as the target information item group; and call the desensitization policy according to the database configuration information of each target information item in the target information item group and the designated user identity identifier to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database.

[0087] For other target information items except the information item group in the database access statement, the server can call the desensitization policy according to the database configuration information of the target information item and the specified user identity identifier to desensitize the data under the corresponding target information item extracted from the target database.

[0088] By further configuring the desensitization strategy corresponding to the information item group, the desensitization strategy configuration can be made more in line with the requirements of the application scenario, further improving the flexibility of data desensitization processing.

[0089] In other embodiments, the server may also receive data of the target information item extracted from the target database based on the database access statement; accordingly, the data of the target information item extracted from the target database is desensitized based on the retrieved desensitization strategy.

[0090] In other embodiments, the server may also rewrite the database access statement based on the retrieved desensitizing strategy to access the target database based on the rewritten database access statement, extract the desensitized data of the target information item, and receive the desensitized data of the target information item fed back by the target database.

[0091] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. For details, please refer to the description of the aforementioned related processing embodiments, and no further description is given here.

[0092] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0093] The data desensitization method described in the above embodiment, by pre-sorting out information items layer by layer based on databases, database tables, and information item identifiers, can make the location of information items more accurate and comprehensive. Desensitization is then configured for each information item based on user identity and business application type, making the desensitization policy configuration more consistent with the needs of actual application scenarios, increasing the flexibility of data desensitization processing, and ensuring that the desensitized data better meets actual application needs.

[0094] Based on the data desensitization processing method described above, one or more embodiments of this specification also provide a data desensitization processing device. The device may include a system, software (application), module, component, server, etc. that uses the method described in the embodiment of this specification and is combined with the necessary implementation hardware. Based on the same innovative concept, the device in one or more embodiments provided in the embodiment of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the device are similar, the implementation of the specific device in the embodiment of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. As used below, the term "unit" or "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0095] Figure 3 A schematic diagram of the module structure of an embodiment of a data desensitization processing device provided in the specification is shown as follows: Figure 3 As shown, when applied to a server, the device may include:

[0096] The request receiving module 30 is used to receive a data access request sent by a client, wherein the data access request includes a specified user identity and a database access statement;

[0097] A parsing module 32 is configured to parse the database access statement to obtain database configuration information of the target information item; the database configuration information at least includes the target database where the target information item is located, the database table, and the information item identifier of the target information item;

[0098] A calling module 34 is used to call a desensitization policy according to the database configuration information of the target information item and the designated user identity, so as to perform desensitization processing on the data under the target information item extracted from the target database;

[0099] The feedback module 36 is configured to feed back the desensitized data of the target information item to the client as response data of the data access request.

[0100] In some other embodiments, the device further includes: a judgment module for judging whether there is an information item group among the two or more target information items when the database access statement includes more than two target information items; the information items in the information item group are associated with a specified desensitization strategy when they are accessed together.

[0101] In some other embodiments, the retrieval module is also used to, when an information item group exists in the two or more target information items, use the corresponding information item group as the target information item group; and retrieve the desensitization policy based on the database configuration information of each target information item in the target information item group and the designated user identity identifier to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database.

[0102] In other embodiments, the calling module is also used to call the desensitization policy for other target information items in the database access statement except the information item group, based on the database configuration information of the target information item and the specified user identity identifier, so as to desensitize the data under the corresponding target information item extracted from the target database.

[0103] In other embodiments, the desensitization strategy includes at least a desensitization processing method configured based on a desensitization algorithm and not performing desensitization processing.

[0104] In some other embodiments, the user identity identifier includes at least a level identifier of the user; and the desensitization strategy is constructed based on at least the level identifier in the user identity identifier.

[0105] In some other embodiments, the desensitization policy is at least associated with a business application type identifier; accordingly, the data access request also includes a specified business application type identifier.

[0106] In some other embodiments, the retrieval module is further used to retrieve the desensitization policy based on the database configuration information of the target information item, the designated user identity identifier, and the designated business application type identifier.

[0107] In some other embodiments, the apparatus further comprises a data receiving module for receiving data of the target information item extracted from the target database based on the database access statement;

[0108] Correspondingly, the retrieval module is further configured to perform desensitization processing on the data of the target information item extracted from the target database based on the retrieved desensitization strategy.

[0109] In some other embodiments, the device further comprises:

[0110] A statement rewriting module is used to rewrite the database access statement based on the retrieved desensitization strategy, so as to access the target database based on the rewritten database access statement and extract the desensitized data of the target information item;

[0111] The data receiving module is further configured to receive desensitized data of the target information item fed back by the target database.

[0112] It should be noted that the above-mentioned device may also include other implementations according to the description of the method embodiment. Specific implementations can refer to the description of the relevant method embodiment and will not be described in detail here.

[0113] The data desensitization processing device described in the above embodiment can make the positioning of information items more accurate and comprehensive by pre-sorting out information items layer by layer based on databases, database tables, and information item identifiers. Desensitization processing is then configured for each information item based on user identity and business application type, making the desensitization policy configuration more consistent with the needs of actual application scenarios, improving the flexibility of data desensitization processing, and making the desensitized data more consistent with actual application needs.

[0114] Based on the data desensitization processing method described above, one or more embodiments of this specification also provide a computer-readable storage medium having computer instructions stored thereon, which implement the steps of the method described in any one or more of the above embodiments when the instructions are executed. The storage medium may include a physical device for storing information, which is usually to digitize the information and then store it in a medium using electrical, magnetic or optical methods. The storage medium may include: devices that use electrical energy to store information, such as various types of memories, such as RAM, ROM, etc.; devices that use magnetic energy to store information, such as hard disks, floppy disks, magnetic tapes, magnetic core memories, bubble memories, and USB flash drives; devices that use optical methods to store information, such as CDs or DVDs. Of course, there are other types of readable storage media, such as quantum memories, graphene memories, and so on.

[0115] It should be noted that the storage medium described above may also include other implementation methods according to the description of the method or device embodiment. The specific implementation methods can refer to the description of the relevant method embodiments and will not be described in detail here.

[0116] The storage medium described in the above embodiment can make the location of information items more accurate and comprehensive by pre-sorting out information items layer by layer based on databases, database tables, and information item identifiers. Desensitization processing is then configured for each information item based on user identity and business application type, making the desensitization policy configuration more consistent with the needs of actual application scenarios, increasing the flexibility of data desensitization processing, and making the desensitized data more in line with actual application needs.

[0117] The embodiments of this specification are not limited to situations that must conform to standard data models / templates or the embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the custom methods or embodiments can also achieve the same, equivalent or similar implementation effects as the above embodiments, or the expected implementation effects after deformation. The embodiments obtained by applying these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of this specification.

[0118] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0119] In the description of this specification, reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification.

[0120] In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and integrate different embodiments or examples described in this specification, as well as features of different embodiments or examples, unless they are mutually inconsistent.

[0121] The foregoing is merely an example of the present invention and is not intended to limit the present invention. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. A data desensitization processing method, characterized in that: Applied to a server, the server is configured with at least one desensitization policy for an information item, the desensitization policy being a method of performing desensitization processing on data of the information item; The desensitization strategy is at least associated with a user identity identifier; the method includes: Receive a data access request sent by a client, wherein the data access request includes a specified user identity and a database access statement; Parsing the database access statement to obtain database configuration information of the target information item; the database configuration information at least includes a target database where the target information item is located, a database table in the target database, and an information item identifier in the database table; Retrieving a desensitization policy based on the database configuration information of the target information item and the designated user identity identifier to perform desensitization processing on the data under the target information item extracted from the target database, wherein the desensitization policy configured for each information item identifier is different for different target databases and database tables in the target database; Feedback the desensitized data of the target information item as response data of the data access request to the client; The method further comprises: When several information items are accessed together, after the information item of non-sensitive data becomes the information item of sensitive data, an information item group is configured; Accordingly, when the database access statement includes two or more target information items, it is determined whether there is an information item group among the two or more target information items; the information items in the information item group are associated with a specified desensitization strategy when they are accessed together, and the specified desensitization strategy is different from the desensitization strategy adopted when the information items are accessed individually; In the case that an information item group exists in the two or more target information items, taking the corresponding information item group as the target information item group; The desensitization strategy is called according to the database configuration information of each target information item in the target information item group and the designated user identity identifier to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database; wherein, the database access statement also includes data requirement information, and accordingly, the data under any target information item in the target information item group extracted from the target database includes: based on the database configuration information and data requirement information of the target information item in the database access statement, accessing the target database where the target information item is located, and extracting data under the specified conditions under any target information item in the target information item group.

2. The method according to claim 1, characterized in that The desensitization strategy includes at least a desensitization processing mode configured based on a desensitization algorithm and not performing desensitization processing.

3. The method according to claim 1, characterized in that For other target information items in the database access statement except the information item group, the desensitization strategy is called according to the database configuration information of the target information item and the designated user identity identifier to desensitize the data under the corresponding target information item extracted from the target database.

4. The method according to claim 1, wherein The desensitization policy is at least associated with a business application type identifier; accordingly, the data access request also includes a specified business application type identifier.

5. The method according to claim 4, characterized in that The method further comprises: The desensitization policy is retrieved according to the database configuration information of the target information item, the designated user identity identifier, and the designated business application type identifier.

6. The method according to claim 1, characterized in that The method further comprises: receiving data of the target information item extracted from the target database based on the database access statement; Correspondingly, the data of the target information item extracted from the target database is desensitized based on the retrieved desensitization strategy.

7. The method according to claim 1, characterized in that The method further comprises: Rewriting the database access statement based on the retrieved desensitization strategy, accessing the target database based on the rewritten database access statement, and extracting desensitized data of the target information item; Receive desensitized data of the target information item fed back by the target database.

8. The method according to claim 1, characterized in that The user identity identifier includes at least a user level identifier; and the desensitization strategy is constructed based at least on the level identifier in the user identity identifier.

9. A data desensitization processing device, characterized in that: Applied to a server, the server is configured with at least one desensitization policy for an information item, the desensitization policy being a method of performing desensitization processing on data of the information item; The desensitization strategy is at least associated with a user identity identifier; the device includes: A request receiving module, configured to receive a data access request sent by a client, wherein the data access request includes a specified user identity and a database access statement; a parsing module, configured to parse the database access statement to obtain database configuration information of the target information item; the database configuration information at least includes a target database where the target information item is located, a database table in the target database, and an information item identifier in the database table; A calling module, configured to call a desensitization policy based on the database configuration information of the target information item and the designated user identity identifier, so as to perform desensitization processing on the data under the target information item extracted from the target database, wherein the desensitization policy configured for each information item identifier is different for different target databases and database tables in the target database; A feedback module, configured to feed back the desensitized data of the target information item as response data to the data access request to the client; Wherein, the device further includes: a determination module configured to, when the database access statement includes two or more target information items, determine whether an information item group exists among the two or more target information items; information items in the information item group are associated with a specified desensitization policy when accessed together, the specified desensitization policy being different from a desensitization policy used when the information items are accessed individually; wherein, when several information items are accessed together, an information item group is configured after an information item of non-sensitive data becomes an information item of sensitive data; The calling module is also used to, when an information item group exists in the more than two target information items, use the corresponding information item group as the target information item group; call the desensitization strategy according to the database configuration information of each target information item in the target information item group and the designated user identity identifier, so as to perform desensitization processing on the data under any target information item in the target information item group extracted from the target database; wherein, the database access statement also includes data requirement information, and accordingly, the data under any target information item in the target information item group extracted from the target database includes: based on the database configuration information and data requirement information of the target information item in the database access statement, access the target database where the target information item is located, and extract data under the specified conditions under any target information item in the target information item group.

10. The device according to claim 9, characterized in that The calling module is also used to call the desensitization strategy for other target information items in the database access statement except the information item group according to the database configuration information of the target information item and the specified user identity identifier, so as to desensitize the data under the corresponding target information item extracted from the target database.

11. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instructions are executed, the steps of the method according to any one of claims 1 to 8 are implemented.

Images