Data processing method and apparatus

Abstract

This application provides a data processing method and apparatus. The method includes: acquiring at least one preset rule, wherein each preset rule corresponds to its own security level; acquiring a first field to be identified, the first field including multiple field data; and determining a target security level corresponding to the first field based on the at least one preset rule and the field data in the first field. By acquiring multiple preset rules with preset configurations and acquiring the first field whose security level needs to be identified, and then determining the preset rule that matches the field data of the first field from the at least one preset rule, since each preset rule corresponds to its own security level, the preset rule of the first field can be determined based on the matching preset rule. This effectively and quickly achieves automatic determination of the security level of the field, thereby effectively improving the efficiency of determining the data security level.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to a data processing method and apparatus. Background Technology

[0002] With the continuous development of big data-related technologies, protecting data security has become a very important part of data processing.

[0003] When protecting data, it is common practice to set corresponding security levels for the data. Currently, in related technologies, the security level of data is usually manually labeled.

[0004] However, when dealing with large amounts of data, manually labeling data security levels can lead to low operational efficiency in determining data security levels. Summary of the Invention

[0005] This application provides a data processing method and apparatus to overcome the problem of low operational efficiency in determining data security levels.

[0006] In a first aspect, embodiments of this application provide a data processing method, including:

[0007] Obtain at least one preset rule, wherein each preset rule corresponds to its respective security level;

[0008] Obtain the first field to be identified, which includes multiple field data;

[0009] The target security level corresponding to the first field is determined by matching the data in the first field with the at least one preset rule.

[0010] In one possible design, the step of matching the first field with the field data in the first field according to at least one preset rule to determine the target security level corresponding to the first field includes:

[0011] From the multiple fields of data in the first field, obtain a first preset number of fields to be matched;

[0012] Based on the first preset number of fields to be matched, a target rule matching the first field is determined from the at least one preset rule;

[0013] Based on the security level corresponding to the target rule, determine the target security level corresponding to the first field.

[0014] In one possible design, for any of the preset rules, the preset rule includes a preset regular expression;

[0015] The step of determining a target rule that matches the first field from the at least one preset rule based on the first preset number of field data to be matched includes:

[0016] Obtain the preset regular expression from the preset rules;

[0017] Determine the matching result between the first preset number of fields to be matched and the preset regular expression, wherein the matching result is either a successful match or a failed match;

[0018] If the number of matching fields is greater than or equal to the second preset number, then the preset rule is determined as the target rule, wherein the second preset number is less than or equal to the first preset number.

[0019] In one possible design, determining the target security level corresponding to the first field based on the security level corresponding to the target rule includes:

[0020] Obtain the number of the target rules;

[0021] If the number of target rules is 1, then the security level corresponding to the target rule is determined to be the security level corresponding to the first field;

[0022] If the number of target rules is greater than 1, then the maximum security level corresponding to the target rule is determined as the security level corresponding to the first field.

[0023] In one possible design, after determining the target security level corresponding to the first field, the method further includes:

[0024] The target security level corresponding to the first field is updated periodically with a preset duration.

[0025] In one possible design, the field message of the first field is stored in a field message queue, and the field message is used to indicate the security level for identifying the first field; obtaining the first field to be identified includes:

[0026] Scan the field message queue, and obtain the first field based on the field message of the first field in the field message queue; or,

[0027] Based on the received data query request, the first field is obtained, wherein the data query request includes target field data to be queried, and the target field data belongs to the first field.

[0028] In one possible design, the first field belongs to a first table, and the first table belongs to a first database; the table messages of the first table are stored in a table message queue, and the table messages are used to indicate the security level of each field in the first table; the database messages of the first database are stored in a database message queue, and the database messages are used to indicate the security level of each field in the first database.

[0029] Before scanning the field message queue and obtaining the first field based on the field message of the first field in the field message queue, the method further includes:

[0030] Obtain at least one database to be scanned, and store the database messages of each database into the database message queue;

[0031] In addition, the database message queue is scanned, and at least one table to be scanned in the first database is obtained according to the database message of the first database in the database message queue, and the table message corresponding to each table is stored in the table message queue.

[0032] In addition, the table message queue is scanned, and at least one field to be scanned in the first table is obtained according to the table message of the first table in the table message queue, and the field message corresponding to each field is stored in the field message queue.

[0033] Secondly, embodiments of this application provide a data processing apparatus, including:

[0034] The first acquisition module is used to acquire at least one preset rule, wherein each preset rule corresponds to its own security level;

[0035] The second acquisition module is used to acquire the first field to be identified, which includes multiple field data.

[0036] The determination module is used to match the data in the first field with the at least one preset rule to determine the target security level corresponding to the first field.

[0037] In one possible design, the determining module is specifically used for:

[0038] From the multiple fields of data in the first field, obtain a first preset number of fields to be matched;

[0039] Based on the first preset number of fields to be matched, a target rule matching the first field is determined from the at least one preset rule;

[0040] Based on the security level corresponding to the target rule, determine the target security level corresponding to the first field.

[0041] In one possible design, for any of the preset rules, the preset rule includes a preset regular expression;

[0042] The determining module is specifically used for:

[0043] Obtain the preset regular expression from the preset rules;

[0044] Determine the matching result between the first preset number of fields to be matched and the preset regular expression, wherein the matching result is either a successful match or a failed match;

[0045] If the number of matching fields is greater than or equal to the second preset number, then the preset rule is determined as the target rule, wherein the second preset number is less than or equal to the first preset number.

[0046] In one possible design, the determining module is specifically used for:

[0047] Obtain the number of the target rules;

[0048] If the number of target rules is 1, then the security level corresponding to the target rule is determined to be the security level corresponding to the first field;

[0049] If the number of target rules is greater than 1, then the maximum security level corresponding to the target rule is determined as the security level corresponding to the first field.

[0050] In one possible design, the determining module is further configured to:

[0051] After determining the target security level corresponding to the first field, the target security level corresponding to the first field is updated periodically at a preset time interval.

[0052] In one possible design, the field message of the first field is stored in a field message queue, and the field message is used to indicate the security level of the first field; the second acquisition module is specifically used for:

[0053] Scan the field message queue, and obtain the first field based on the field message of the first field in the field message queue; or,

[0054] Based on the received data query request, the first field is obtained, wherein the data query request includes target field data to be queried, and the target field data belongs to the first field.

[0055] In one possible design, the first field belongs to a first table, and the first table belongs to a first database; the table messages of the first table are stored in a table message queue, and the table messages are used to indicate the security level of each field in the first table; the database messages of the first database are stored in a database message queue, and the database messages are used to indicate the security level of each field in the first database.

[0056] The second acquisition module is also used for:

[0057] Before scanning the field message queue and obtaining the first field based on the field message of the first field in the field message queue,

[0058] Obtain at least one database to be scanned, and store the database messages of each database into the database message queue;

[0059] In addition, the database message queue is scanned, and at least one table to be scanned in the first database is obtained according to the database message of the first database in the database message queue, and the table message corresponding to each table is stored in the table message queue.

[0060] In addition, the table message queue is scanned, and at least one field to be scanned in the first table is obtained according to the table message of the first table in the table message queue, and the field message corresponding to each field is stored in the field message queue.

[0061] Thirdly, embodiments of this application provide a data processing apparatus, including:

[0062] Memory, used to store programs;

[0063] A processor for executing the program stored in the memory, wherein, when the program is executed, the processor is configured to perform the method described in the first aspect above and any of the various possible designs of the first aspect.

[0064] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the methods described in the first aspect above and any of the various possible designs of the first aspect.

[0065] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect above and any of the various possible designs of the first aspect.

[0066] This application provides a data processing method and apparatus. The method includes: acquiring at least one preset rule, wherein each preset rule corresponds to its own security level; acquiring a first field to be identified, the first field including multiple field data; and determining a target security level corresponding to the first field based on the at least one preset rule and the field data in the first field. By acquiring multiple preset rules with preset configurations and acquiring the first field whose security level needs to be identified, and then determining the preset rule that matches the field data of the first field from the at least one preset rule, since each preset rule corresponds to its own security level, the preset rule of the first field can be determined based on the matching preset rule. This effectively and quickly achieves automatic determination of the security level of the field, thereby effectively improving the efficiency of determining the data security level. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is a schematic diagram of data protection in the related technology provided in the embodiments of this application;

[0069] Figure 2 A flowchart illustrating the data processing method provided in the embodiments of this application;

[0070] Figure 3 Flowchart of the data processing method provided in the embodiments of this application Figure 2 ;

[0071] Figure 4 A schematic diagram illustrating the implementation of the rule configuration provided in this application embodiment;

[0072] Figure 5 A schematic diagram illustrating the implementation of the preset rules provided in the embodiments of this application;

[0073] Figure 6 This is a schematic diagram illustrating the implementation of the data storage structure provided in the embodiments of this application;

[0074] Figure 7 A schematic diagram illustrating the implementation of a message queue provided in an embodiment of this application;

[0075] Figure 8 A schematic diagram illustrating the implementation of determining the matching result provided in an embodiment of this application;

[0076] Figure 9A schematic diagram illustrating the implementation of determining the security level of the first field in an embodiment of this application;

[0077] Figure 10 A schematic diagram of the interface for the security levels of various fields provided in the embodiments of this application;

[0078] Figure 11 A flowchart illustrating the data processing method provided in an embodiment of this application;

[0079] Figure 12 This application provides an example of the implementation of user levels and security levels. Figure 1 ;

[0080] Figure 13 This application provides an example of the implementation of user levels and security levels. Figure 2 ;

[0081] Figure 14 This is a schematic diagram of the structure of the data processing apparatus provided in the embodiments of this application;

[0082] Figure 15 This is a schematic diagram of the hardware structure of the data processing device provided in the embodiments of this application. Detailed Implementation

[0083] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0084] To better understand the technical solution of this application, the relevant technologies involved in this application will be further described in detail below.

[0085] With the continuous development of big data-related technologies, the importance of data security is increasing day by day. Therefore, data security protection has become a very important part of the data processing process.

[0086] In the current context of big data, when all data is gathered in a data warehouse, there will inevitably be some sensitive data. Therefore, all sensitive data in the data warehouse should be protected to ensure that sensitive data is not leaked.

[0087] In a given example, consider hundreds of databases, each containing hundreds of tables, each with 50 fields, and each field containing 1 million records. In practice, ensuring that all sensitive data across these 100 * 100 * 50 * 1 million = 500 billion fields is not leaked from the big data platform is crucial. This is an enormous undertaking.

[0088] The following can be combined Figure 1 To understand the implementation of data protection in related technologies, Figure 1 This is a schematic diagram illustrating data protection in the related technologies provided in the embodiments of this application.

[0089] Reference Figure 1 In data protection technologies, it's common practice to grant plaintext viewing access to specific groups of people. This means these individuals can directly access all data in the data warehouse, including sensitive data. These groups might include data analysts, scientists, and others. However, despite their privileged status, granting plaintext access still puts sensitive data at risk of leakage.

[0090] At the same time, refer to Figure 1 Besides the specific groups mentioned above, when viewing data, the system typically anonymizes the data and then provides the anonymized data to the non-specific groups. However, in some cases, the non-specific groups also require plaintext data for processing. For example, developers may need data for testing. If developers only use anonymized data for testing, it may not be possible to guarantee that the developed product will function correctly on unanonymized data.

[0091] Therefore, based on the above explanation, it's understandable that the current approach of granting plaintext viewing access to all data only to specific groups leads to a lack of flexibility in data protection. Therefore, it's advisable to consider setting different security levels for different types of data, thereby enabling flexible data display based on actual circumstances.

[0092] Currently, in existing technologies, setting security levels for data typically involves operators reviewing the data and assigning it the corresponding security level. However, with the continuous development of related technologies, the volume of data is now enormous. Therefore, this manual method of assigning security levels results in extremely low operational efficiency for determining data security levels.

[0093] To address the problems in the existing technology, this application proposes the following technical concept: by setting multiple preset rules, each of which can include its own corresponding security level, data can be matched with the preset rules, and the security level of the successfully matched preset rule can be determined as the security level of the current data, thereby automatically and efficiently determining the security level of the data.

[0094] Based on the above description, the data processing method provided in this application will be described below with reference to specific embodiments. It is worth noting that the execution subject of each embodiment in this application can be a server, processor, microprocessor or other device with data processing function. In actual implementation, the specific implementation of the execution subject can be selected according to actual needs. This embodiment does not limit this. Any device with data processing function can be used as the execution subject of each embodiment in this application.

[0095] The following is a combination of... Figure 2 To introduce, Figure 2 A flowchart illustrating the data processing method provided in this application embodiment.

[0096] like Figure 2 As shown, the method includes:

[0097] S201. Obtain at least one preset rule, wherein each preset rule corresponds to its own security level.

[0098] In this embodiment, multiple preset rules can be set, each used to match subsequent data. Each preset rule can correspond to a security level. In one possible implementation, the security levels can be divided into: plaintext, sensitive, confidential, top secret, etc., where different security levels correspond to different levels of data protection. The degree of data protection required for the four security levels described above increases sequentially. In actual implementation, the specific division of security levels can be selected according to actual needs, as long as different security levels correspond to different levels of data protection.

[0099] Furthermore, the preset rules in this embodiment are used to describe the corresponding data. Therefore, the preset rules can describe expressions of the data, etc., and then the expressions and corresponding data can be matched to achieve the matching of the preset rules and the data.

[0100] S202. Obtain the first field to be identified, which includes multiple field data.

[0101] The first field can be understood as the specific meaning of the data. For example, the first field can be "ID card number", "name", etc. The first field can include multiple fields of data. For example, the first field of data in the first field can be a specific ID card number, a specific name, etc.

[0102] In actual implementation, a data warehouse can contain multiple fields. In this embodiment, the first field can be any one of the multiple fields. The implementation method for each field is similar, and any field that needs to identify the security level can be used as the first field in this embodiment.

[0103] S203. Match the data in the first field with at least one preset rule to determine the target security level corresponding to the first field.

[0104] In this embodiment, the preset rules are used to match the field data. Therefore, after obtaining the preset rules and the field data in the first field, for example, the preset rules can be matched with the field data in the first field according to at least one preset rule to determine the preset rule that the current first field matches. Then, for example, the target security level corresponding to the first field can be determined according to the security level of the preset rules that the first field matches.

[0105] The data processing method provided in this application includes: acquiring at least one preset rule, wherein each preset rule corresponds to its own security level; acquiring a first field to be identified, the first field including multiple field data; and determining the target security level corresponding to the first field based on the at least one preset rule and the field data in the first field. By acquiring multiple preset rules with preset configurations and acquiring the first field whose security level needs to be identified, and then determining the preset rule that matches the field data of the first field from the at least one preset rule, since each preset rule corresponds to its own security level, the preset rule of the first field can be determined based on the matching preset rule, thereby effectively and quickly realizing the automatic determination of the security level of the field, and effectively improving the efficiency of determining the data security level.

[0106] Based on the above embodiments, the following is combined with Figures 3 to 10 The data processing method provided in this application will be described in further detail. Figure 3 Flowchart of the data processing method provided in the embodiments of this application Figure 2 , Figure 4 This is a schematic diagram illustrating the implementation of the rule configuration provided in an embodiment of this application. Figure 5 This is a schematic diagram illustrating the implementation of the preset rules provided in the embodiments of this application. Figure 6 This is a schematic diagram illustrating the implementation of the data storage structure provided in the embodiments of this application. Figure 7This is a schematic diagram illustrating the implementation of a message queue provided in an embodiment of this application. Figure 8 This is a schematic diagram illustrating the implementation of determining the matching result in an embodiment of this application. Figure 9 This is a schematic diagram illustrating the implementation of determining the security level of the first field in an embodiment of this application. Figure 10 This is a schematic diagram of the interface for the security levels of various fields provided in the embodiments of this application.

[0107] like Figure 3 As shown, the method includes:

[0108] S301. Obtain at least one preset rule, wherein each preset rule corresponds to its own security level.

[0109] The implementation of S301 is similar to that of S201, and will not be described in detail here.

[0110] It is also understood that at least one preset rule in this embodiment is pre-configured, as described below. Figure 4 This section introduces how to implement pre-configured preset rules.

[0111] like Figure 4 As shown, when configuring preset rules, you can configure rule name, rule notes, rule content, rule category, security level, and also set the effective status.

[0112] The rule name is the name of the currently configured preset rule, which can reflect the specific meaning of the rule, etc. This embodiment does not limit this. For example, the rule name can be "sensitive word", "domain name", etc. The specific setting of the rule name can be selected according to actual needs.

[0113] Furthermore, rule comments can be corresponding comments made when configuring preset rules. For example, they can be explanations of the current rule, or descriptions of the usage specifications of the current rule, etc. This embodiment does not limit the specific implementation of rule comments, and any content can be commented according to actual needs.

[0114] Furthermore, the rules contained therein are the preset regular expressions mentioned above. Below is a brief explanation of the preset regular expressions. Specifically, a regular expression describes a string matching pattern, which can be used to check whether a string contains a certain substring, replace the matched substring, or extract a substring from a string that meets a certain condition, etc.

[0115] Therefore, regular expressions can be pre-defined to describe different types of strings. For example, a regular expression can be used to describe an ID card number, and the ID card number can be matched with the corresponding regular expression. Similarly, a regular expression can be used to describe a mobile phone number, and the mobile phone number can be matched with the corresponding regular expression.

[0116] Therefore, it's understandable that subsequent rule matching involves matching against preset regular expressions. In one possible implementation, each configured preset rule includes a preset regular expression. (And refer to...) Figure 4 To determine the correctness of a regular expression while inputting it, you can, for example,... Figure 4 The location indicated by 401 provides an input box for testing regular expressions. By setting the test input box, you can quickly and effectively determine whether the current regular expression configuration is correct, thereby effectively improving the efficiency and correctness of rule configuration.

[0117] Furthermore, the rule classification can be a specific business type of the currently configured rule, such as a test or a template classification. This embodiment does not limit the specific implementation of the rule classification, which can be set according to actual business needs.

[0118] Furthermore, each preset rule is assigned a corresponding security level, which is the security level in this embodiment. In one possible implementation, the security level may include... Figure 4 The four security levels shown as "plaintext, sensitive, confidential, and top secret" increase in that order, meaning the level of protection required for the data increases accordingly.

[0119] In actual implementation, each rule includes a preset regular expression during rule configuration. Therefore, for each rule, it can be determined what type of data the current rule matches, and thus the corresponding level of data protection can be determined. Therefore, each preset rule can be set with its own corresponding security level. The specific implementation of the security level corresponding to each preset rule can be selected and set according to actual needs. This embodiment does not impose any restrictions on this.

[0120] and reference Figure 4 For each security rule configured, its activation status can be configured before confirmation. If the activation status is "enabled," then clicking... Figure 4 After clicking the confirmation button, the preset rule will take effect immediately. If the effect status is off, then clicking the confirmation button will activate the rule. Figure 4 After clicking the confirmation button, the preset rule will not take effect temporarily. It will take effect later, for example, according to the activation command.

[0121] The above combination Figure 4 This section introduces the configuration for preset rules; we will now combine that with... Figure 5 Understand the pre-configured rules.

[0122] Reference Figure 5 , Figure 5 The provided code lists multiple preset rules. For example, the preset rule indicated by the 501 error has the rule name "Domain Name," the rule category "Template Category," and the regular expression included in its rule content is... Figure 5 The regular expression identified in the text can be understood as a regular expression describing the domain name, and the rule notes can be "domain name", its security level such as "confidential", and the de-identification algorithm corresponding to the current rule can also be included in the preset rules.

[0123] At the same time, refer to Figure 5 For each preset rule, the user interface can also provide corresponding operation controls, such as... Figure 5 The close control and adjustment rule control shown in 502 can, for example, set the corresponding preset rule to "close" when an operation on the close control is detected. And, when an operation on the adjustment rule control is detected, for example, the above-mentioned... Figure 5 The rule editing interface shown allows users to adjust preset rules. After adjustment, users can submit the adjusted preset rules to modify them.

[0124] In actual implementation, the specific options that can be configured in the preset rules, the specific implementation of each configuration information in the preset rules, the operable content of the operation interface of the preset rules, etc., can all be selected according to actual needs. This embodiment does not impose any special restrictions on this, as long as the corresponding preset rules can be configured according to actual needs, the preset rules include regular expressions, and each regular expression corresponds to its own security level, and the corresponding addition, modification, deletion and query can be performed on each preset rule.

[0125] Therefore, based on the above introduction, it can be determined that in this embodiment, by configuring preset rules, multiple preset regular expressions can be set. The preset regular expressions can describe the corresponding data. Therefore, in this embodiment, field data can be matched with preset regular expressions.

[0126] S302. Obtain the first field to be identified, which includes multiple field data.

[0127] The implementation of S301 is similar to that of S201. The following section will further introduce the possible implementation methods for obtaining the first field to be identified.

[0128] In this embodiment, the first field to be identified may be, for example, the field currently queried by the user. In one possible implementation of obtaining the first field to be identified, the first field can be obtained according to the received data query request, wherein the data query request includes the target field data to be queried, and the target field data belongs to the first field.

[0129] For example, a user can input a data query request in the client, specifying what data the user wants to retrieve. The client then generates a data query request based on the user's input. This current implementation means that the security level of the first field containing the relevant data is determined in real-time as the user queries the data.

[0130] Alternatively, in this embodiment, each field currently stored can be scanned sequentially to predetermine the security level corresponding to each field. This current implementation means that the security level of each field is pre-generated before the user queries the data.

[0131] Therefore, in another possible implementation of obtaining the first field to be identified, the field message of the first field can be stored in a field message queue. The field message is used to indicate the security level of identifying the first field. For example, the field message queue can be scanned, and the first field can be obtained according to the field message of the first field in the field message queue.

[0132] For example, you can refer to Figure 6 Understanding the data storage structure, such as Figure 6 As shown, for example, data storage can include multiple databases, such as... Figure 6 The databases shown are 601, 602, ..., 60n. Each database can include multiple tables; for example, database 601 can include tables 6011, 6012, 6013, 6014, etc. Each table can include multiple fields; for example, table 6011 can include the field indicated by 60111. In one possible implementation, a column in a table can be a single field, or a row in a table can be a single field; this embodiment does not limit this.

[0133] And each field can include multiple records, with each record containing data for one field, for example... Figure 6Field 60111 can include field data 601111. It's understood that the field data within a single field all have the same meaning. For example, if field 60111 is specifically a "name" field, then all fields within field 60111 contain the name data; similarly, if field 60111 is specifically a "phone number" field, then all fields within field 60111 contain the phone number data. In actual implementation, the number of databases, tables within the database, the number of fields in each table, the meaning of each field, the amount of data within each field, the specific data content of each field, etc., can all be selected and set according to actual needs. This embodiment does not limit the specific implementation method of the data.

[0134] Therefore, in this embodiment, the first field may belong to the first table, and the first table may belong to the first database.

[0135] It is also understandable that the current implementation method is to pre-generate the corresponding security level for each field. However, in actual data warehouses, the amount of data is very large. Therefore, it is quite labor-intensive to pre-determine the corresponding security level for each field. In order to improve the processing efficiency of pre-generating the security level of each field, one possible implementation method is to use a message queue to identify the security level of each field.

[0136] For example, it can be combined Figure 7 To understand, such as Figure 7 As shown, for example, three types of message queues can be set up: database message queue, table message queue, and field message queue.

[0137] Then refer to Figure 7 For example, it can be executed Figure 7 Service 1 shown is: obtaining a database list. This list can include multiple databases. It is understood that in this embodiment, each database can be scanned individually. Therefore, based on the database list, the database messages for at least one database to be scanned are stored in a database message queue. These database messages indicate the security level of each field in each table of the corresponding database. In other words, each database corresponds to one message in the database message queue. Assuming there are 100 databases, for example, 100 messages can be generated in the database message queue.

[0138] Furthermore, the database message queue can be scanned to retrieve database messages to be identified. In this embodiment, "to be identified" refers to the security level to be identified. Based on the above description, it can be determined that each database can include multiple tables. It is understood that in this embodiment, each table is scanned. Figure 7 For example, it can be executed Figure 7 Service 2 shown: Scan the database message list to obtain database messages for the first database, and based on the database messages for the first database, obtain at least one table to be scanned in the first database. Then, the table messages corresponding to each of the at least one table to be scanned can be stored in a table message queue, where each table corresponds to one message in the table message queue. Assuming there are currently 100 databases, and each database contains 100 tables, the table message queue can contain a maximum of 10,000 messages.

[0139] Furthermore, the table message queue can be scanned to retrieve the table messages to be identified. Based on the above description, it can be determined that each table can include multiple fields. It is understood that in this embodiment, each field is scanned. Figure 7 For example, it can be executed Figure 7 Service 3 shown: Scan the table message queue, obtain the table messages of the first table, and based on the table messages of the first table, obtain at least one field to be scanned in the first table. Then, the field messages corresponding to each field can be stored in the field message queue, where each field corresponds to one message in the field message queue. The above assumes the existence of 100 databases, each database containing 100 tables, and each table containing 50 fields. Therefore, the field message queue can contain a maximum of 500,000 messages.

[0140] Then, the field message of the first field to be identified can be retrieved from the field message queue, thereby obtaining the first field, and then, for example, execution can be performed. Figure 5 Service 4 shown: Based on the field message, obtain the field data in the corresponding first field, and then determine the security level corresponding to the current first field based on the field data.

[0141] Based on the above introduction, it can be understood that services 1, 2, 3, and 4 are respectively set up for the four different levels of data structures: database, table, field, and field data. It is certain that each of these four services produces messages for downstream services to consume and also consumes messages produced by upstream services. Therefore, by setting up these different levels of consumption queues, parallel processing between the various consumption queues can be achieved. For example, while the database list is enqueuing messages into the database message queue, subsequent table and field processing can be executed in parallel without waiting for the database scan to complete.

[0142] Furthermore, the services described above can be understood as different processing units. To improve processing efficiency, multiple concurrent threads can be set up for each service's processing unit, allowing each service to execute the aforementioned processing process in parallel across multiple lines. Additionally, because the number of messages in the database message queue, table message queue, and field message queue varies significantly, different numbers of concurrent threads can be set for different services, taking into account the different message volumes and resource consumption of each message queue.

[0143] For example, if service 1 has the fewest messages to process, then the number of concurrent threads for service 1 can be set to the minimum. On the other hand, if service 4 has the most messages to consume, then the more concurrent threads for service 4, the better. In actual implementation, the number of concurrent threads for each service can be selected and set according to actual needs, as long as it can effectively improve the efficiency of identifying the security level of each field.

[0144] Therefore, in summary, this embodiment can pre-generate the security level corresponding to each field and store the security level of each field in a preset storage space. Then, the required field's security level can be directly queried. Alternatively, the security level of the first field containing the data to be queried can be generated in real-time during data querying. The specific implementation method can be selected and set according to actual needs, and this embodiment does not limit this.

[0145] S303. Among the multiple field data of the first field, obtain a first preset number of field data to be matched.

[0146] In this embodiment, each field can correspond to multiple field data. For example, a first preset number of field data to be matched can be obtained from the multiple field data corresponding to the first field. These field data to be matched are the field data for subsequent matching processing. It is understood that the number of field data included in each field is very large. By obtaining the first preset number of field data to be matched and performing subsequent matching processing, the workload of matching processing can be effectively reduced, thereby improving the efficiency of determining the security level of the field.

[0147] When obtaining a first preset number of field data to be matched from multiple field data corresponding to the first field, for example, using N to represent the first preset number, one can choose the first N field data as the field data to be matched, or one can choose the last N field data as the field data to be matched, or one can randomly select N field data as the field data to be matched. In this embodiment, there is no restriction on which field data to be matched are specifically, as long as the number of field data to be matched is the first preset number and is selected from multiple field data corresponding to the first field.

[0148] Furthermore, the first preset quantity can be, for example, 1000, which means selecting 1000 field data points from the multiple field data points corresponding to the first field as the field data to be matched. In actual implementation, the specific implementation of the first preset quantity can be selected and set according to actual needs, and this embodiment does not impose any restrictions on it.

[0149] S304. Obtain the preset regular expression from the preset rules.

[0150] Based on the above description, it can be determined that any preset rule in this embodiment includes a preset regular expression. In this embodiment, for example, each preset rule can correspond to its own security level. For example, the field data can be matched with the preset regular expressions in each preset rule. When the match is successful, the security level corresponding to the preset rule can be determined as the security level of the first field corresponding to the current field data.

[0151] The implementation of any preset rule is similar, so we will take any preset rule as an example below. The implementation of other preset rules is similar. For example, we can obtain the preset regular expression of the preset rule.

[0152] S305. Determine the matching results of the first preset number of fields to be matched and the preset regular expression. The matching result is either a successful match or a failed match.

[0153] In this embodiment, it is necessary to match a first preset number of fields to be matched with multiple preset regular expressions.

[0154] Specifically, for any given preset regular expression, this embodiment can determine the matching results of a first preset number of fields to be matched and the preset regular expression, where the matching result is either a successful match or a failed match.

[0155] The above matching can be performed for each preset regular expression. Therefore, in this embodiment, for example, the matching results of a first preset number of fields to be matched and each preset regular expression can be determined.

[0156] S306. If the number of matching fields is greater than or equal to the second preset number, the preset rule is determined as the target rule, wherein the second preset number is less than or equal to the first preset number.

[0157] For any given preset regular expression, after matching the first preset number of fields to be matched with the preset regular expression, the matching result (successful or unsuccessful) can be determined. For example, the number of fields to be matched that are successfully matched out of the first preset number of fields to be matched can be determined. Then, the number of successfully matched fields is compared with the second preset number. If the number of successfully matched fields is greater than or equal to the second preset number, it can be determined that the current preset regular expression matches the current first field successfully. Then, the preset rule corresponding to the current regular expression can be determined as the target rule. In this embodiment, the second preset number is less than or equal to the first preset number.

[0158] In one possible implementation, the second preset quantity can be, for example, half of the first preset quantity. That is, as long as more than half of the fields to be matched in the first preset quantity of data are successfully matched, it can be determined that the current preset regular expression and the current first field are successfully matched. Alternatively, the second preset quantity can also be, for example, 2 / 3 of the first preset quantity, and so on. This embodiment does not limit the specific implementation of the second preset quantity, which can be selected and set according to actual needs. It can be understood that the second preset quantity is a threshold used to measure whether the current preset regular expression and the first field are successfully matched, as long as it is less than the first preset quantity.

[0159] The following can be combined Figure 8 To facilitate understanding, the following explanation will use a first preset quantity of 5 and a second preset quantity as an example. Figure 8 As shown, there are currently 5 fields of data to be matched, namely... Figure 8The fields 1, 2, 3, 4, and 5 shown are used to match the preset regular expression a. Each field to be matched is then matched against the preset regular expression a to determine the matching result for each field.

[0160] Reference Figure 8 Assuming that the matching results for field data 1, field data 2, field data 4, and field data 5 are all successful, while the matching result for field data 3 is a failed match, then it can be determined that 4 out of the 5 fields to be matched are successful. Therefore, the number of fields to be matched with a successful match result is greater than the second preset number 3. Thus, it can be determined that the current preset regular expression is the target regular expression, and consequently, the preset rule corresponding to the current preset regular expression 'a' is the target rule.

[0161] The above describes the processing procedure for a specific preset regular expression. In actual implementation, the above process can be performed for each preset regular expression, thereby determining the target rule among multiple preset rules.

[0162] S307. Obtain the number of target rules.

[0163] Based on the above description, it can be determined that the target regular expression in this embodiment is the regular expression that successfully matches the first field, and each preset regular expression corresponds to its own security level. Therefore, in this embodiment, the security level of the target regular expression can be determined as the security level corresponding to the first field. The number of target regular expressions may be only one or multiple.

[0164] The implementation methods for a single target regular expression and multiple target regular expressions differ, therefore the number of target rules obtained is currently limited.

[0165] S308. If the number of target rules is 1, then the security level corresponding to the target rule is determined to be the security level corresponding to the first field.

[0166] In one possible implementation, if the number of target rules is 1, the security level corresponding to the target rule can be directly determined as the security level corresponding to the first field. For example, if the security level corresponding to the target rule is confidential, then the security level corresponding to the current first field can also be determined as confidential.

[0167] S309. If the number of target rules is greater than 1, then the maximum security level corresponding to the target rule shall be determined as the security level corresponding to the first field.

[0168] In another possible implementation, if the number of target rules is greater than 1, it can be determined that there are multiple preset rules that match the first field, and the maximum security level corresponding to the target rule can be determined as the security level corresponding to the first field.

[0169] For example, you can refer to Figure 9 To understand this, let's assume we're currently focusing on the first field, and we've determined that... Figure 9 The three target rules shown are preset rule a, preset rule b, and preset rule c. Assuming preset rule a corresponds to a top-secret security level, preset rule b corresponds to a confidential security level, and preset rule c corresponds to a confidential security level, then the highest security level among these three preset rules, "top-secret," can be determined as the security level corresponding to the first field. Figure 9 In the example shown, the security level corresponding to the first field is "Top Secret".

[0170] The above describes how to determine the security level of each field. In one possible implementation, after determining the security level of each field, the security level of each field can be stored in a preset storage space. Furthermore, the security levels of each field stored in the preset storage space can be updated periodically at preset intervals, such as daily or monthly. This embodiment does not impose any limitations on this. The specific implementation of the update involves re-executing the process described above, which will not be elaborated upon here.

[0171] Furthermore, the security level of each field stored in the preset storage space can also be referenced, for example, by referring to... Figure 10 To understand.

[0172] like Figure 10 As shown, for each field, information such as the table it belongs to, the database it belongs to, the application it belongs to, the name of the currently matched preset rule, the corresponding security level, and the current security level's on / off status can be recorded. All of this information can be displayed in the graphical user interface, allowing users to quickly and effectively determine the relevant information for each field.

[0173] For example Figure 10 The number 1001 indicates that field 1 belongs to table 1, database 1, and application 08021. Here, 08021 could be, for example, the application ID. The matching rule is an ID card number, the current security level is confidential, and the current security status is enabled. The implementation of the remaining fields follows the same principle. Figure 10 This will not be elaborated upon here.

[0174] At the same time, refer to Figure 10 For each field, corresponding operation controls can also be provided in the graphical user interface, for example... Figure 10 The close control and security level adjustment control shown in 1002 can, for example, set the security level of the corresponding field to "close" when an operation on the close control is detected. Similarly, when an operation on the security level adjustment control is detected, an intensive editing interface can be displayed, allowing the user to adjust the current field's security level on the intensive editing page. Furthermore, a control for querying the security level of a corresponding field can be provided in the graphical user interface, for example, by referring to... Figure 10 In option 1003, users can filter the content they need to query based on their actual requirements.

[0175] The data processing method provided in this application can flexibly and effectively determine the security level of each field by pre-generating the security level corresponding to each field, or by generating the security level corresponding to each field in real time. Specifically, when determining the security level of a field, a first preset number of field data to be matched are matched against a preset regular expression. The security level corresponding to the target regular expression is then determined as the security level of the current field. The regular expression is a dynamic description of the field data; that is, regardless of changes in the field data, as long as it conforms to the rules described by the corresponding regular expression, matching can be achieved. Compared to matching based on fixed preset keywords, matching based on regular expressions effectively improves the flexibility and effectiveness of the matching process. Furthermore, selecting a first preset number of field data to be matched for processing effectively reduces the workload of the matching process, thereby improving the efficiency of determining the security level of a field.

[0176] It should be noted that the first field in this embodiment may include one field, in which case the target field data can be directly generated based on the display method corresponding to the current first field and the corresponding first field data. Furthermore, the first field in this embodiment may also include multiple fields, in which case each field can correspond to its own display method. For example, based on the display method corresponding to each field, the corresponding first field data can be processed accordingly to generate the target field data corresponding to each field.

[0177] The data processing method provided in this application includes: receiving a data acquisition request sent by a client, the data acquisition request including a first user's identifier and a query instruction, the query instruction being used to query data in a first field. Obtaining the security level corresponding to the first field, and obtaining the first user's user level based on the first user's identifier. Determining the display method corresponding to the first field based on the security level and the first user's user level, the display method being either plaintext display or display after anonymization. Generating target field data based on the display method and the first field data, and sending the target field data to the client. By obtaining the security level of the first field queried by the first user, and obtaining the first user's user level, and then determining the display method for the first field based on the security level and the first user's user level, the method can effectively determine the specific data processing method according to the user's actual data access needs and the actual required level of data protection, thereby effectively improving the flexibility of data protection.

[0178] Based on the embodiments described above, the following is combined with... Figures 11-13 This paper describes the process of implementing the data processing method provided in this application in a specific application scenario. Figure 11 This is a flowchart illustrating the data processing method provided in an embodiment of this application. Figure 12 This application provides an example of the implementation of user levels and security levels. Figure 1 , Figure 13 This application provides an example of the implementation of user levels and security levels. Figure 2 .

[0179] like Figure 11 As shown:

[0180] 1. Users can submit data retrieval requests to the query component through the client. The data retrieval request can include the identifier of the first user and the query instruction described in the above embodiment.

[0181] 2. The query component can then retrieve data from the database according to the query command;

[0182] 3. The queried database can return query results to the query component, which includes the first field data that the user wants to obtain;

[0183] 4. The query component can pass the identifier of the first user and the query results to the de-identification component;

[0184] 5. The de-identification component determines the table containing the query results and the first field based on the query results. It can also obtain the security level of the first field and the user level of the first user based on the first user's identifier. Then, based on the security level and user level, it determines the display method for the data in the first field. The display method can be plain text display or display after de-identification processing.

[0185] Specifically, in this embodiment, each field corresponds to its own security level. The security level of each field can be preset or generated in real time. The implementation method can be referred to the above description, and will not be repeated here.

[0186] Furthermore, in this embodiment, each user is also assigned a corresponding user level. In one possible implementation, for example, the user registration corresponding to the identifier of each user can be stored in a preset storage space. Then, for example, the user level of the first user can be obtained from the preset storage space based on the identifier of the first user.

[0187] In one possible implementation, the user level division can be as described above: plaintext, sensitive, confidential, top secret, etc., or the user level division can also be: level 1, level 2, level 3, level 4, etc. This embodiment does not limit the specific implementation of the user level division, and it can be selected and set according to actual needs, as long as different user levels correspond to different data access permissions.

[0188] It is understandable that there is a hierarchy between user level and security level. In one possible implementation, user level and security level can be completely identical, as shown in the reference... Figure 12 Both user level and security level are Figure 12 The four levels shown are, from highest to lowest, "Top Secret, Confidential, Sensitive, Plaintext," meaning Top Secret > Confidential > Sensitive > Plaintext. Therefore, the relationship between user level and security level is exactly this one.

[0189] like Figure 12 As shown, when a user's level is Top Secret, the security levels of the data they can view in plaintext include Top Secret, Confidential, Sensitive, and Plaintext; when a user's level is Confidential, the security levels of the data they can view in plaintext include Confidential, Sensitive, and Plaintext; when a user's level is Sensitive, the security levels of the data they can view in plaintext include Sensitive and Plaintext; and when a user's level is Plaintext, the security levels of the data they can view in plaintext include Plaintext.

[0190] For example in Figure 12In the example, assuming the current user level is confidential and the security level corresponding to the first field is confidential, it can be determined that the user level is equal to the security level corresponding to the first field. Therefore, it can be determined that the first field is displayed in plaintext.

[0191] For example, in Figure 12 In the example, assuming the current user level is confidential, but the security level corresponding to the first field is top secret, it can be determined that the user level is lower than the security level corresponding to the first field. Therefore, it can be determined that the first field is displayed after being de-identified.

[0192] Alternatively, user level and security level may not be completely identical, but rather have a corresponding relationship, as shown in the reference. Figure 13 For example, user levels can be Figure 13 The levels shown are Level 1, Level 2, Level 3, Level 4, Level 5, Level 6, Level 7, and Level 8, and the security levels can be... Figure 13 The text displayed is classified as Top Secret, Confidential, Sensitive, and Plain Text. Figure 13 The hierarchical relationship described above could be as follows: Level 1 and Level 2 of a user could correspond to Top Secret in security level; Level 3 and Level 4 of a user could correspond to Confidential in security level; Level 5 and Level 6 of a user could correspond to Sensitive in security level; and Level 7 and Level 8 of a user could correspond to Plaintext in security level.

[0193] In other words, when a user's level is level 1 or 2, the security level of the data they can view in plaintext includes top secret, confidential, sensitive, and plaintext; when a user's level is level 3 or 4, the security level of the data they can view in plaintext includes confidential, sensitive, and plaintext; when a user's level is level 5 or 6, the security level of the data they can view in plaintext includes sensitive and plaintext; and when a user's level is level 7 or 8, the security level of the data they can view in plaintext includes plaintext.

[0194] For example, in Figure 13 In the example, assuming the current user level is level four and the security level corresponding to the first field is sensitive (level five and six and above can be accessed in plaintext), it can be determined that the user level is greater than the security level corresponding to the first field. Therefore, it can be determined that the first field is displayed in plaintext.

[0195] For example, in Figure 13 In the example, assuming the current user level is level eight, but the security level corresponding to the first field is sensitive (only level five and six and above can access in plaintext), then it can be determined that the user level is lower than the security level corresponding to the first field. Therefore, it can be determined that the first field is displayed after being de-identified.

[0196] In actual implementation, the specific settings of user level and security level can be selected according to actual needs, and the correspondence between user level and security level can also be selected and configured according to actual needs. Accordingly, the relationship between each user level and each security level can be determined. This embodiment does not impose any restrictions on this.

[0197] After determining the security level corresponding to the first field and the user level of the first user, for example, it can be determined whether the current user level of the first user exceeds the security level corresponding to the first field, thereby determining the subsequent display method corresponding to the first field. In this embodiment, the display method can be plaintext display, or it can be display after desensitization processing.

[0198] For example, if the first user's user level does not exceed the security level corresponding to the first field, it means that the current user has the permission to directly view the data in the first field, and the display method could be, for example, plaintext. Alternatively, if the first user's user level exceeds the security level corresponding to the first field, it means that the current user cannot directly view the data in the first field, and the display method would also be, for example, after anonymization.

[0199] In the actual implementation process, the specific desensitization processing can be selected and set according to actual needs. For example, it may include processing methods such as replacement, obfuscation, and masking. This embodiment does not limit this.

[0200] 6. After determining the display method, the target field data can be obtained based on the first field data. This target field data is then returned to the query component, which can then provide it to the client for display. This completes the data query operation, flexibly and effectively implementing data protection throughout.

[0201] After determining the display method corresponding to the first field, the target field data to be displayed can be generated based on the display method corresponding to the first field and the queried first field data. The target field data may include, for example, some anonymized first field data and some unanonymized first field data. The target field data can then be sent to the client so that the client can display the target field data.

[0202] The obtained target field data can then be sent to the client, allowing the client to process the target field data and present it to the user. The user can then view the data they need, which can be displayed directly or after anonymization, depending on the user's user level and the security level of the field being viewed.

[0203] Furthermore, by comparing the security level corresponding to the first field with the user level of the first user, it can be determined whether the data in the first field should be displayed in plaintext or after anonymization. This allows for the determination of the specific data access method based on the actual protection requirements of the data and the user's actual access permissions, thus enabling flexible handling of data protection.

[0204] Figure 14 This is a schematic diagram of the structure of the data processing apparatus provided in an embodiment of this application. Figure 14 As shown, the device 140 includes: a first acquisition module 1401, a second acquisition module 1402, and a determination module 1403.

[0205] The first acquisition module 1401 is used to acquire at least one preset rule, wherein each preset rule corresponds to its own security level;

[0206] The second acquisition module 1402 is used to acquire a first field to be identified, wherein the first field includes multiple field data;

[0207] The determination module 1403 is used to match the data in the first field with the at least one preset rule to determine the target security level corresponding to the first field.

[0208] In one possible design, the determining module 1403 is specifically used for:

[0209] From the multiple fields of data in the first field, obtain a first preset number of fields to be matched;

[0210] Based on the first preset number of fields to be matched, a target rule matching the first field is determined from the at least one preset rule;

[0211] Based on the security level corresponding to the target rule, determine the target security level corresponding to the first field.

[0212] In one possible design, for any of the preset rules, the preset rule includes a preset regular expression;

[0213] The determining module 1403 is specifically used for:

[0214] Obtain the preset regular expression from the preset rules;

[0215] Determine the matching result between the first preset number of fields to be matched and the preset regular expression, wherein the matching result is either a successful match or a failed match;

[0216] If the number of matching fields is greater than or equal to the second preset number, then the preset rule is determined as the target rule, wherein the second preset number is less than or equal to the first preset number.

[0217] In one possible design, the determining module 1403 is specifically used for:

[0218] Obtain the number of the target rules;

[0219] If the number of target rules is 1, then the security level corresponding to the target rule is determined to be the security level corresponding to the first field;

[0220] If the number of target rules is greater than 1, then the maximum security level corresponding to the target rule is determined as the security level corresponding to the first field.

[0221] In one possible design, the determining module 1403 is further configured to:

[0222] After determining the target security level corresponding to the first field, the target security level corresponding to the first field is updated periodically at a preset time interval.

[0223] In one possible design, the field message of the first field is stored in a field message queue, and the field message is used to indicate the security level of the first field; the second acquisition module 1402 is specifically used for:

[0224] Scan the field message queue, and obtain the first field based on the field message of the first field in the field message queue; or,

[0225] Based on the received data query request, the first field is obtained, wherein the data query request includes target field data to be queried, and the target field data belongs to the first field.

[0226] In one possible design, the first field belongs to a first table, and the first table belongs to a first database; the table messages of the first table are stored in a table message queue, and the table messages are used to indicate the security level of each field in the first table; the database messages of the first database are stored in a database message queue, and the database messages are used to indicate the security level of each field in the first database.

[0227] The second acquisition module 1402 is also used for:

[0228] Before scanning the field message queue and obtaining the first field based on the field message of the first field in the field message queue,

[0229] Obtain at least one database to be scanned, and store the database messages of each database into the database message queue;

[0230] In addition, the database message queue is scanned, and at least one table to be scanned in the first database is obtained according to the database message of the first database in the database message queue, and the table message corresponding to each table is stored in the table message queue.

[0231] In addition, the table message queue is scanned, and at least one field to be scanned in the first table is obtained according to the table message of the first table in the table message queue, and the field message corresponding to each field is stored in the field message queue.

[0232] The apparatus provided in this embodiment can be used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects are similar, and will not be described again here.

[0233] Figure 15 This is a schematic diagram of the hardware structure of the data processing device provided in the embodiments of this application, such as... Figure 15 As shown, the data processing device 150 of this embodiment includes: a processor 1501 and a memory 1502; wherein

[0234] Memory 1502 is used to store instructions executed by the computer;

[0235] Processor 1501 is used to execute computer execution instructions stored in memory to implement the various steps of the data processing method in the above embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0236] Alternatively, the memory 1502 can be either standalone or integrated with the processor 1501.

[0237] When the memory 1502 is set up independently, the data processing device also includes a bus 1503 for connecting the memory 1502 and the processor 1501.

[0238] This application also provides a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the data processing method executed by the data processing device described above.

[0239] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0240] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0241] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0242] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0243] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0244] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0245] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0246] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data processing method, characterized by, The method comprises: obtaining at least one preset rule, wherein each of the preset rules corresponds to a respective security level; for any of the preset rules, the preset rule comprises a rule name, a rule note, a rule content, a rule classification, a security level, and a validity state; wherein the rule content comprises a preset regular expression; obtaining a first field to be identified, the first field comprising a plurality of field data; obtaining a first preset number of field data to be matched from the plurality of field data of the first field; obtaining the preset regular expression in the preset rule; determining a matching result of the first preset number of field data to be matched and the preset regular expression, the matching result being a match success or a match failure; if the number of field data to be matched that is a match success is greater than or equal to a second preset number, then the preset rule is determined as a target rule, wherein the second preset number is less than or equal to the first preset number; obtaining the number of target rules; if the number of target rules is 1, then the security level corresponding to the target rule is determined as the security level corresponding to the first field; if the number of target rules is greater than 1, then the maximum security level corresponding to the target rule is determined as the security level corresponding to the first field; the field message of the first field is stored in a field message queue, the field message being used to indicate the identification of the security level of the first field; the obtaining of the first field to be identified comprises: scanning the field message queue to obtain the first field according to the field message of the first field in the field message queue; or obtaining the first field according to a received data query request, wherein the data query request comprises target field data to be queried, and the target field data belongs to the first field; the first field belongs to a first table, and the first table belongs to a first database; a table message of the first table is stored in a table message queue, the table message being used to indicate the identification of the security level of each field in the first table; a database message of the first database is stored in a database message queue, the database message being used to indicate the identification of the security level of each field in the first database; wherein the plurality of message queues are processed in parallel, and different numbers of concurrent threads are set for different queues; before the scanning of the field message queue to obtain the first field according to the field message of the first field in the field message queue, the method further comprises: obtaining at least one database to be scanned, and storing the database message of each of the databases in the database message queue; and scanning the database message queue to obtain at least one table to be scanned in the first database according to the database message of the first database in the database message queue, and storing the table message corresponding to each of the tables in the table message queue. and scanning the table message queue to obtain at least one field to be scanned in a first table in the table message queue according to a table message of the first table in the table message queue, and storing a field message corresponding to each of the fields into the field message queue.

2. The method of claim 1, wherein, After the target security level corresponding to the first field is determined, the method further comprises: updating the target security level corresponding to the first field periodically with a preset time length as a period.

3. A data processing apparatus, characterized by, comprises: a first obtaining module, configured to obtain at least one preset rule, wherein each of the preset rules corresponds to a respective security level; a second obtaining module, configured to obtain a first field to be identified, wherein the first field comprises a plurality of field data; a determining module, configured to determine a target security level corresponding to the first field according to matching of the at least one preset rule and the field data in the first field; the determining module is specifically configured to: obtain a first preset number of field data to be matched in the plurality of field data of the first field; determine a target rule matching the first field in the at least one preset rule according to the first preset number of field data to be matched; determine the target security level corresponding to the first field according to a security level corresponding to the target rule; for any one of the preset rules, the preset rule comprises a rule name, a rule note, a rule content, a rule classification, a security level, and a valid state; wherein the rule content comprises a preset regular expression; the determining module is specifically configured to: obtain the preset regular expression in the preset rule; determine a matching result of the first preset number of field data to be matched and the preset regular expression, wherein the matching result is matching success or matching failure; if the number of matching field data to be matched that is matching success is greater than or equal to a second preset number, the preset rule is determined as the target rule, wherein the second preset number is less than or equal to the first preset number; the determining module is specifically configured to: obtain the number of target rules; if the number of target rules is 1, the security level corresponding to the target rule is determined as the security level corresponding to the first field; if the number of target rules is greater than 1, the maximum security level corresponding to the target rule is determined as the security level corresponding to the first field; the field message of the first field is stored in a field message queue, and the field message is used to indicate identification of the security level of the first field; and the second obtaining module is specifically configured to: scan the field message queue to obtain the first field according to the field message of the first field in the field message queue; or obtain the first field according to a received data query request, wherein the data query request comprises target field data to be queried, and the target field data belongs to the first field; The first field belongs to a first table, and the first table belongs to a first database; a table message of the first table is stored in a table message queue, and the table message is used to indicate a security level identifying each field in the first table; a database message of the first database is stored in a database message queue, and the database message is used to indicate a security level identifying each field in the first database; wherein the message queues are processed in parallel, and different numbers of concurrent threads are set for different queues; The second obtaining module is further configured to: before the scanning of the field message queue, according to a field message of a first field in the field message queue, obtaining at least one field in the first field, obtaining at least one database to be scanned, and storing database messages of the databases into the database message queue respectively; and scanning the database message queue, according to a database message of a first database in the database message queue, obtaining at least one table in the first database to be scanned, and storing table messages corresponding to the tables into a table message queue respectively; and scanning the table message queue, according to a table message of a first table in the table message queue, obtaining at least one field in the first table to be scanned, and storing field messages corresponding to the fields into the field message queue respectively.

4. The apparatus of claim 3, wherein, The determining module is further configured to: after the determination of the target security level corresponding to the first field, periodically updating the target security level corresponding to the first field with a preset time length as a period.

5. A data processing device, characterized by comprise: a memory, configured to store a program; a processor, configured to execute the program stored in the memory, and when the program is executed, the processor is configured to execute the method in any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that, comprise instructions which, when executed on a computer, cause the computer to perform the method in any one of claims 1 to 2.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method in any one of claims 1 to 2.

Images