A data processing method and device

Abstract

The present invention discloses a data processing method and device, and relates to the field of computer technology. A specific implementation of the method includes: after receiving a business request from an external platform, calling a business interface according to the parameters of the business request to obtain business result data; scanning sensitive data in the business result data to determine the type of sensitive data; obtaining a desensitizing configuration corresponding to the type of sensitive data, desensitizing the sensitive data according to the desensitizing configuration, and obtaining desensitized business result data to send to the external platform. This implementation can dynamically update obfuscated sensitive data, ensure that the obfuscated data is not cracked, and improve the security of sensitive data; according to the type of sensitive data, different desensitizing schemes are used to dynamically desensitize sensitive data, adapting to desensitization tasks in various business scenarios.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data processing method and device. Background Art

[0002] When ISVs (third-party independent software service providers) use open data, sensitive data may be involved. For example, in the e-commerce industry, ISVs use the data and service capabilities of e-commerce companies to serve various merchants, so the security of sensitive data in open data has received great attention. Currently, the method of desensitizing sensitive data is relatively simple, and it is generally encrypted by AES (Advanced Encryption Standard) and / or RSA algorithm.

[0003] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0004] The desensitization processing method is single and cannot adapt to the desensitization tasks of various business scenarios. Moreover, for some fixed sensitive data, once the secret key is leaked and the encryption method is cracked, the sensitive data will be permanently leaked, and the security is low. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a data processing method and device, which can dynamically desensitize sensitive data using different desensitization schemes according to the type of sensitive data, adapt to desensitization tasks in various business scenarios, and dynamically update obfuscated sensitive data to ensure that the obfuscated data cannot be cracked, thereby improving the security of sensitive data.

[0006] To achieve the above objective, according to one aspect of an embodiment of the present invention, a data processing method is provided.

[0007] A data processing method comprises: after receiving a business request from an external platform, calling a business interface according to the parameters of the business request to obtain business result data; scanning sensitive data in the business result data to determine the type of the sensitive data; obtaining a desensitizing configuration corresponding to the type of the sensitive data, desensitizing the sensitive data according to the desensitizing configuration, and obtaining the desensitized business result data for sending to the external platform.

[0008] Optionally, calling the business interface according to the parameters of the business request to obtain business result data includes: obtaining obfuscated user information from the parameters of the business request; obtaining user information plaintext corresponding to the obfuscated user information from the cache; and calling the business interface according to the user information plaintext to obtain the business result data.

[0009] Optionally, before receiving the business request of the external platform, it includes: receiving an authentication request from the external platform, calling a user interface according to the authentication request to obtain the plaintext user information from the user interface; converting the plaintext user information into the obfuscated user information; sending the obfuscated user information to the external platform, and storing the correspondence between the plaintext user information and the obfuscated user information in the cache.

[0010] Optionally, the cache has an expiration time, and the expiration time is dynamically set according to a timestamp of the authentication request and a preset rule.

[0011] Optionally, converting the plaintext of the user information into the obfuscated user information includes: using the plaintext of the user information as an input parameter of an obfuscation algorithm, using the credential information pre-sent to the external platform and / or the timestamp of the authentication request as other input parameters of the obfuscation algorithm, generating a random string through the obfuscation algorithm, and obtaining the obfuscated user information.

[0012] Optionally, determining the type of the sensitive data includes: acquiring a desensitizing knowledge base, and determining the type of the sensitive data based on the desensitizing knowledge base.

[0013] Optionally, the desensitizing configuration includes desensitizing rules and dynamically updateable desensitizing parameters; desensitizing the sensitive data according to the desensitizing configuration to obtain the desensitized business result data includes: according to the desensitizing rules, using the current desensitizing parameters in the desensitizing configuration, performing data obfuscation processing on the sensitive data to obtain the desensitized business result data.

[0014] According to another aspect of an embodiment of the present invention, a data processing device is provided.

[0015] A data processing device includes: a business result data generation module, which is used to call a business interface according to the parameters of the business request after receiving a business request from an external platform to obtain business result data; a sensitive data type determination module, which is used to scan the sensitive data in the business result data to determine the type of the sensitive data; and a desensitizing module, which is used to obtain a desensitizing configuration corresponding to the type of the sensitive data, desensitize the sensitive data according to the desensitizing configuration, and obtain the desensitized business result data for sending to the external platform.

[0016] Optionally, the business result data generation module is also used to: obtain obfuscated user information from the parameters of the business request; obtain user information plaintext corresponding to the obfuscated user information from the cache; and call the business interface according to the user information plaintext to obtain the business result data.

[0017] Optionally, it also includes a user information obfuscation module, which is used to: receive an authentication request from the external platform, call a user interface according to the authentication request to obtain the user information plaintext from the user interface; convert the user information plaintext into the obfuscated user information; send the obfuscated user information to the external platform, and store the correspondence between the user information plaintext and the obfuscated user information in the cache.

[0018] Optionally, the cache has an expiration time, and the expiration time is dynamically set according to a timestamp of the authentication request and a preset rule.

[0019] Optionally, the user information obfuscation module is also used to: use the plain text of the user information as an input parameter of the obfuscation algorithm, use the credential information pre-sent to the external platform and / or the timestamp of the authentication request as other input parameters of the obfuscation algorithm, generate a random string through the obfuscation algorithm, and obtain the obfuscated user information.

[0020] Optionally, the sensitive data type determination module is further used to: obtain a desensitizing knowledge base, and determine the type of the sensitive data based on the desensitizing knowledge base.

[0021] Optionally, the desensitizing configuration includes desensitizing rules and dynamically updateable desensitizing parameters; the desensitizing module is also used to: perform data obfuscation processing on the sensitive data according to the desensitizing rules and use the current desensitizing parameters in the desensitizing configuration to obtain the desensitized business result data.

[0022] According to yet another aspect of the embodiments of the present invention, an electronic device is provided.

[0023] An electronic device comprises: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the data processing method provided by an embodiment of the present invention.

[0024] According to yet another aspect of an embodiment of the present invention, a computer readable medium is provided.

[0025] A computer-readable medium stores a computer program, wherein the program, when executed by a processor, implements the data processing method provided in an embodiment of the present invention.

[0026] An embodiment of the above invention has the following advantages or beneficial effects: after receiving a business request from an external platform, calling a business interface according to the parameters of the business request to obtain business result data; scanning sensitive data in the business result data to determine the type of sensitive data; obtaining a desensitization configuration corresponding to the type of sensitive data, desensitizing the sensitive data according to the desensitization configuration, and obtaining desensitized business result data to send to the external platform. Based on the type of sensitive data, different desensitization schemes can be used to dynamically desensitize sensitive data, adapting to desensitization tasks in a variety of business scenarios, and dynamically updating obfuscated sensitive data to ensure that the obfuscated data is not cracked, thereby improving the security of sensitive data.

[0027] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0029] Figure 1 is a schematic diagram of main steps of a data processing method according to an embodiment of the present invention;

[0030] Figure 2 is a schematic diagram of a process of obfuscating data of a user's plain text identifier according to an embodiment of the present invention;

[0031] Figure 3 is a schematic diagram of a process flow of a service request processing according to an embodiment of the present invention;

[0032] Figure 4 is a schematic diagram of a process of obfuscated dynamic desensitization of sensitive data according to an embodiment of the present invention;

[0033] Figure 5 is a schematic diagram of main modules of a data processing device according to an embodiment of the present invention;

[0034] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0035] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0037] Figure 1 It is a schematic diagram of main steps of a data processing method according to an embodiment of the present invention.

[0038] like Figure 1 As shown, a data processing method according to an embodiment of the present invention mainly includes the following steps S101 to S103.

[0039] Step S101: After receiving a service request from an external platform, a service interface is called according to the parameters of the service request to obtain service result data.

[0040] Among them, the data processing method of the embodiment of the present invention can be executed by an open platform (for example, executed on the server of the development platform), and the external platform is, for example, an ISV platform (hereinafter referred to as ISV). The ISV can send a service request to the open platform of the embodiment of the present invention through its server or terminal.

[0041] Calling a business interface according to the parameters of a business request to obtain business result data may include: obtaining obfuscated user information from the parameters of the business request; obtaining user information plaintext corresponding to the obfuscated user information from a cache; and calling a business interface according to the user information plaintext to obtain business result data.

[0042] User information, such as a user ID, may specifically be a user's mobile phone number, ID number, account information, email address, etc. The above-mentioned various user IDs are only examples, and the embodiments of the present invention are not limited to the above-mentioned user IDs.

[0043] In addition to the obfuscated user information, the service request may also include other parameters set according to service requirements, which is not limited in the embodiment of the present invention.

[0044] The business interface is an interface provided by the upstream system of the open platform of the embodiment of the present invention. Taking the business request as an order query request, the upstream system may be an order system. The business interface is the order query interface provided by the order system. The business result data is the result obtained by the upstream system processing the business request. For the above-mentioned order query, the business result data is the queried order information.

[0045] Before receiving a business request from an external platform, the process may include: receiving an authentication request from the external platform, calling a user interface according to the authentication request to obtain plaintext user information from the user interface; converting the plaintext user information into obfuscated user information; sending the obfuscated user information to the external platform, and storing the correspondence between the plaintext user information and the obfuscated user information in a cache.

[0046] The authentication request may be issued when an external platform logs into the open platform of the embodiment of the present invention.

[0047] The user interface is an API interface (application programming interface) that can provide plain text user information for the open platform to call to obtain plain text user information from user groups, etc.

[0048] The cache has an expiration time, which is dynamically set according to the timestamp of the authentication request and preset rules. For example, the cache validity period can be dynamically set, so that the cache expiration time can be dynamically set according to the timestamp and the duration to regularly update the obfuscated user information.

[0049] Converting the plaintext user information into obfuscated user information may include: using the plaintext user information as an input parameter of the obfuscation algorithm, using the credential information pre-sent to the external platform and / or the timestamp of the authentication request as other input parameters of the obfuscation algorithm, generating a random string through the obfuscation algorithm, and obtaining the obfuscated user information.

[0050] Step S102: Scan the sensitive data in the business result data to determine the type of the sensitive data.

[0051] Determining the type of sensitive data may include: obtaining a desensitized knowledge base, and determining the type of sensitive data based on the desensitized knowledge base. Specifically, each type of data in the desensitized knowledge base may be compared with sensitive data in the business result data, and the type of sensitive data in the business result data may be determined based on the data type in the desensitized knowledge base.

[0052] Step S103: Obtain a desensitizing configuration corresponding to the type of sensitive data, perform desensitizing processing on the sensitive data according to the desensitizing configuration, and obtain desensitized business result data to send to an external platform.

[0053] The masking configuration may include masking rules and masking parameters that can be updated dynamically.

[0054] Desensitizing the sensitive data according to the desensitizing configuration to obtain desensitized business result data may include: according to the desensitizing rules, using the current desensitizing parameters in the desensitizing configuration, performing data obfuscation processing on the sensitive data to obtain desensitized business result data.

[0055] Figure 2The figure is a flowchart of data obfuscation of a user's plain text identifier according to an embodiment of the present invention.

[0056] like Figure 2 As shown, the open platform receives an authentication request from the ISV, which contains the application APPKEY (API interface verification serial number), that is, the credential information pre-sent by the open platform to the ISV. The open platform obtains the application APPKEY from the above authentication request and generates a timestamp for the authentication request. According to the authentication request, the open platform obtains the user plaintext identifier (that is, the user information plaintext) by calling the user interface in the API interface (application program interface). Through the data obfuscation random number generation algorithm (that is, the obfuscation algorithm), and using the application APPKEY, the user plaintext identifier, and the timestamp as the input parameters of the obfuscation algorithm, the user plaintext identifier is converted into a random 16-bit number, thereby generating a user obfuscated identifier (that is, the obfuscated user information). The correspondence between the user plaintext identifier and the user obfuscated identifier is stored in the cache, and the cache expiration time is set. The cache expiration time can be set according to the timestamp of the authentication request, such as after a certain time of the timestamp of the authentication request, the cache is invalid. The open platform returns the user obfuscated identifier to the ISV. If the cache is invalid (that is, expired), the ISV resends the authentication request to the open platform and repeats the above steps.

[0057] Since the user's unique identifier is fixed, the prior art uses RSA and / or AES encryption methods. Once the secret key is leaked and the encryption method is cracked, the user's plaintext unique identifier will be permanently leaked. The embodiment of the present invention generates a user obfuscated identifier through a data obfuscation random number generation algorithm, and adopts a dynamic data obfuscation scheme to store the corresponding relationship between the user's plaintext identifier and the user's obfuscated identifier in a cache. The cache is set with an expiration time. After the expiration, a new user obfuscated identifier needs to be regenerated, which can ensure that the obfuscated data cannot be cracked, thereby improving the security of sensitive data such as user identifiers.

[0058] Figure 3 The figure is a flowchart of a service request processing according to an embodiment of the present invention.

[0059] like Figure 3 As shown, the open platform receives a business request from the ISV, which contains a user obfuscation identifier. The open platform obtains the user obfuscation identifier in the business request, and searches the cache for the user plaintext identifier corresponding to the user obfuscation identifier. According to the business request, the user plaintext identifier is passed to the corresponding business interface to obtain the corresponding business result (i.e., business result data). The business result may contain multiple types of sensitive data. According to the obfuscated dynamic desensitization scheme for sensitive data (described in detail below), the sensitive data is desensitized to obtain a desensitized business result. The open platform returns the desensitized business result to the ISV.

[0060] The business request processing flow of the embodiment of the present invention can dynamically desensitize sensitive data using different desensitization schemes according to the type of sensitive data in the business results to obtain desensitized business results, and adapt to desensitization tasks in various business scenarios.

[0061] Figure 4 It is a flowchart of obfuscated dynamic desensitization of sensitive data according to an embodiment of the present invention.

[0062] The obfuscated dynamic desensitization scheme for sensitive data is as follows: Figure 4 As shown, the desensitization knowledge base is a general term for a series of desensitization rules for sensitive data. Desensitization rules may include number-based desensitization rules, account-based desensitization rules, and the like. If the type of sensitive data is a digital identification type, such as a mobile phone number, bank card, ID card number, etc., the corresponding desensitization rule is a number-based desensitization rule, that is, a dynamic parameter is obtained based on the timestamp, and an operation is performed with the plaintext sensitive data, such as a sum operation, and then the middle part of the operation result is replaced with an asterisk "*", such as 12***232. If the type of sensitive data is a type of numbers and letters, such as a user account, mailbox, etc., the corresponding desensitization rule is an account-based desensitization rule, that is, a dynamic parameter is obtained based on the timestamp, and an operation is performed with the ASCII code of the plaintext sensitive data to obtain desensitized data, such as 12@xx.yy.

[0063] Combination Figure 3 The business request processing flow shown in the embodiment of the present invention is to set different dynamic desensitization rules and configure dynamic sensitive data scanning rules on the desensitization management service platform (open platform). Among them, the scanning rules are set in the administrator background system, and each rule can set some attributes, such as whether to scan according to the timestamp, whether to scan according to the string, etc. Through the scanning rules, the business result data is scanned, and the type of sensitive data in the business result data is identified based on the desensitization knowledge base. According to the type of sensitive data, the corresponding desensitization configuration is determined. The desensitization configuration may include desensitization rules and dynamically updateable desensitization parameters. The desensitization parameters may specifically be key data strings. Using a dynamically updateable key data string, once it is cracked, it can be replaced at any time, and the historical data (i.e., the previous key data string) is not the same as the current key data string, so it will not cause data leakage. According to the obtained desensitization rules, the current desensitization parameters in the desensitization configuration are used, and the sensitive data is desensitized by data obfuscation technology to obtain the desensitized business results.

[0064] Figure 5 is a schematic diagram of main modules of a data processing device according to an embodiment of the present invention.

[0065] like Figure 5As shown, a data processing device 500 according to an embodiment of the present invention mainly includes: a business result data generating module 501 , a sensitive data type determining module 502 , and a desensitizing module 503 .

[0066] The business result data generating module 501 is used to call the business interface according to the parameters of the business request to obtain the business result data after receiving the business request from the external platform.

[0067] The sensitive data type determination module 502 is used to scan the sensitive data in the business result data to determine the type of the sensitive data.

[0068] The desensitizing module 503 is used to obtain a desensitizing configuration corresponding to the type of sensitive data, perform desensitizing processing on the sensitive data according to the desensitizing configuration, and obtain desensitized business result data to send to an external platform.

[0069] In one embodiment, the business result data generation module is also used to: obtain obfuscated user information from the parameters of the business request; obtain the user information plaintext corresponding to the obfuscated user information from the cache; call the business interface according to the user information plaintext to obtain the business result data.

[0070] In one embodiment, it also includes a user information obfuscation module, which is used to: receive an authentication request from an external platform, call a user interface according to the authentication request to obtain plain text user information from the user interface; convert the plain text user information into obfuscated user information; send the obfuscated user information to the external platform, and store the correspondence between the plain text user information and the obfuscated user information in a cache.

[0071] In one embodiment, the cache has an expiration time, and the expiration time is dynamically set according to a timestamp of the authentication request and a preset rule.

[0072] In one embodiment, the user information obfuscation module is also used to: use the plain text of the user information as an input parameter of the obfuscation algorithm, use the credential information and / or the timestamp of the authentication request pre-sent to the external platform as other input parameters of the obfuscation algorithm, generate a random string through the obfuscation algorithm, and obtain the obfuscated user information.

[0073] In one embodiment, the sensitive data type determination module is further used to: obtain a desensitized knowledge base, and determine the type of sensitive data based on the desensitized knowledge base.

[0074] In one embodiment, the desensitizing configuration includes desensitizing rules and dynamically updateable desensitizing parameters; the desensitizing module is also used to: perform data obfuscation processing on sensitive data according to the desensitizing rules and use the current desensitizing parameters in the desensitizing configuration to obtain desensitized business result data.

[0075] In addition, the specific implementation content of the data processing device in the embodiment of the present invention has been described in detail in the above data processing method, so the repeated content will not be described again here.

[0076] Figure 6 An exemplary system architecture 600 is shown to which the data processing method or data processing device according to the embodiment of the present invention can be applied.

[0077] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0078] Users can use terminal devices 601, 602, and 603 to interact with server 605 through network 604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 601, 602, and 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0079] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0080] The server 605 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603. The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information - only an example) to the terminal device.

[0081] It should be noted that the data processing method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the data processing device is generally disposed in the server 605 .

[0082] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0083] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention.

[0084] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 7 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0085] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0086] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0087] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0088] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0089] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0090] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be provided in a processor. For example, they may be described as follows: a processor includes a business result data generation module, a sensitive data type determination module, and a desensitization module. Among them, the names of these modules do not constitute a limitation on the module itself under certain circumstances. For example, the business result data generation module may also be described as "a module for calling a business interface according to the parameters of a business request after receiving a business request from an external platform to obtain business result data".

[0091] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device includes: after receiving a business request from an external platform, calling a business interface according to the parameters of the business request to obtain business result data; scanning sensitive data in the business result data to determine the type of sensitive data; obtaining a desensitizing configuration corresponding to the type of sensitive data, desensitizing the sensitive data according to the desensitizing configuration, and obtaining desensitized business result data to send to the external platform.

[0092] According to the technical solution of the embodiment of the present invention, after receiving the business request from the external platform, the business interface is called according to the parameters of the business request to obtain the business result data; the sensitive data in the business result data is scanned to determine the type of sensitive data; the desensitization configuration corresponding to the type of sensitive data is obtained, and the sensitive data is desensitized according to the desensitization configuration to obtain the desensitized business result data to be sent to the external platform. The obfuscated sensitive data can be dynamically updated to ensure that the obfuscated data is not cracked, thereby improving the security of sensitive data; according to the type of sensitive data, different desensitization schemes are used to dynamically desensitize the sensitive data to adapt to desensitization tasks in various business scenarios.

[0093] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data processing method, characterized in that: include: Before receiving a service request from an external platform, receiving an authentication request from the external platform, wherein the authentication request includes credential information pre-sent to the external platform; Calling a user interface according to the authentication request to obtain plaintext user information from the user interface; using the plaintext user information as an input parameter of an obfuscation algorithm, using the credential information pre-sent to the external platform and / or the timestamp of the authentication request as other input parameters of the obfuscation algorithm, generating a random string through the obfuscation algorithm to obtain obfuscated user information; sending the obfuscated user information to the external platform, and storing the corresponding relationship between the plaintext user information and the obfuscated user information in a cache; After receiving a service request from an external platform, obtaining obfuscated user information from parameters of the service request; Obtaining the user information plaintext corresponding to the obfuscated user information from the cache; calling the business interface according to the user information plaintext to obtain business result data; Scanning sensitive data in the business result data to determine the type of the sensitive data; Obtain a desensitizing configuration corresponding to the type of the sensitive data, perform desensitizing processing on the sensitive data according to the desensitizing configuration, and obtain the desensitized business result data to send to the external platform.

2. The method according to claim 1, characterized in that The cache has an expiration time, and the expiration time is dynamically set according to the timestamp of the authentication request and a preset rule.

3. The method according to claim 1, characterized in that: Determining the type of the sensitive data includes: A desensitized knowledge base is obtained, and the type of the sensitive data is determined based on the desensitized knowledge base.

4. The method according to claim 1, characterized in that The desensitization configuration includes desensitization rules and dynamically updateable desensitization parameters; The desensitizing the sensitive data according to the desensitizing configuration to obtain the desensitized business result data includes: According to the desensitization rules, using the current desensitization parameters in the desensitization configuration, the sensitive data is subjected to data obfuscation processing to obtain the desensitized business result data.

5. A data processing device, characterized in that: include: A user information obfuscation module is used to: receive an authentication request from an external platform, wherein the authentication request includes credential information pre-sent to the external platform; Calling a user interface according to the authentication request to obtain plaintext user information from the user interface; using the plaintext user information as an input parameter of an obfuscation algorithm, using the credential information pre-sent to the external platform and / or the timestamp of the authentication request as other input parameters of the obfuscation algorithm, generating a random string through the obfuscation algorithm to obtain obfuscated user information; sending the obfuscated user information to the external platform, and storing the corresponding relationship between the plaintext user information and the obfuscated user information in a cache; A business result data generation module, used to obtain obfuscated user information from the parameters of the business request after receiving the business request from the external platform; Obtaining the user information plaintext corresponding to the obfuscated user information from the cache; calling the business interface according to the user information plaintext to obtain business result data; A sensitive data type determination module, used to scan the sensitive data in the business result data to determine the type of the sensitive data; The desensitizing module is used to obtain a desensitizing configuration corresponding to the type of the sensitive data, desensitize the sensitive data according to the desensitizing configuration, and obtain the desensitized business result data to send to the external platform.

6. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

7. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images