Message desensitization method, device, electronic equipment and medium

Abstract

The present disclosure provides a message desensitization method, which relates to the field of information security. The method is used to desensitize messages received by each traffic node in a distributed system. For any traffic node in the distributed system, the method includes: caching at least one desensitization rule and desensitization algorithm, each desensitization rule includes an application name, a resource name, a preset desensitization field and a preset desensitization type, and each desensitization algorithm corresponds to each preset desensitization type; when the traffic node receives a message request, the field to be desensitized and the type to be desensitized in the message request are obtained, and the field to be desensitized and the type to be desensitized are at least one of the preset desensitization field and the preset desensitization type respectively; according to the preset retrieval method, the number of occurrences and the path of the field to be desensitized in the message request are retrieved, and the desensitization algorithm corresponding to the type to be desensitized is called to desensitize the field to be desensitized. The present disclosure also provides a message desensitization device, an electronic device, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, specifically to the field of data desensitization technology, and more specifically to a message desensitization method, device, electronic device, storage medium and program product. Background Art

[0002] Generally speaking, the use and processing of sensitive information is involved in various scenarios, including R&D, testing, data release, and data analysis. Therefore, data desensitization is considered an essential technical tool in the big data era. Data desensitization involves transforming certain sensitive information using desensitization rules to reliably protect sensitive and private data. To protect user information security, the recording platform must desensitize messages recorded during production.

[0003] Currently, for messages recorded in log format, recording platforms typically perform desensitization during the log writing process by marking the fields that require desensitization. For messages collected using network traffic or bytecode enhancement, recording platforms typically split the collected messages into a pre-configured database for batch desensitization.

[0004] However, log desensitization methods often have the problem of being difficult to manage uniformly due to the diversity of desensitization algorithms. Using database desensitization has the problem of lengthy pipelines, field splitting or reorganization requiring personalized customization, and complex operations, making it difficult to effectively improve desensitization efficiency. Summary of the Invention

[0005] In view of the above problems, the present disclosure provides a message desensitization method, apparatus, electronic device, storage medium and program product for improving the desensitization efficiency of recorded messages.

[0006] According to the first aspect of the present disclosure, a message desensitization method is provided for desensitizing messages received by each traffic node in a distributed system, wherein, for any traffic node in the distributed system, the method includes: caching at least one desensitization rule and desensitization algorithm, each desensitization rule includes an application name, a resource name, a preset desensitization field and a preset desensitization type, and each desensitization algorithm corresponds to each preset desensitization type; when the traffic node receives a message request, obtaining the field to be desensitized and the type to be desensitized in the message request, the field to be desensitized and the type to be desensitized being at least one of the preset desensitization field and the preset desensitization type respectively; and, retrieving the number of occurrences and path of the field to be desensitized in the message request according to a preset retrieval method, and calling the desensitization algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized.

[0007] According to an embodiment of the present disclosure, the message request is a JSON format string, and the preset retrieval method includes: dividing the field to be desensitized into a field array including multiple word segmentation fields with specified characters; converting the JSON format string into JSONObject type data; determining at least one word segmentation field in the field array as a specified field, and traversing the query JSONObject type data to find the number of occurrences and paths of the specified field.

[0008] According to an embodiment of the present disclosure, retrieving the path of the field to be desensitized in the message request includes: traversing layer by layer from the outermost layer of the JSON format string to the shortest path of the specified field.

[0009] According to an embodiment of the present disclosure, the desensitization rules are stored in the relational database management system MySQL, and the full-text search engine Elasticsearch is used to traverse and query the number of occurrences and paths of specified fields contained in JSONObject type data.

[0010] According to an embodiment of the present disclosure, a JSON format string includes a key-value pair consisting of a parameter name and a parameter value, a designated field is at least one parameter name in the JSON format string, and a desensitizing algorithm corresponding to the type to be desensitized is called to desensitize the field to be desensitized, including: calling a desensitizing algorithm corresponding to the type to be desensitized to desensitize the parameter value corresponding to the designated field in the JSON format string.

[0011] According to an embodiment of the present disclosure, after the step of calling the desensitizing algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized, it also includes: replacing the corresponding parameter value in the JSON format string with the desensitized parameter value; converting the replaced JSON format string into a JSON object.

[0012] According to an embodiment of the present disclosure, the method is applied to a traffic recording platform, and the traffic recording platform performs traffic recording through at least one of the following methods: sandbox, embedded SDK, network card acquisition recording, or bytecode enhancement recording.

[0013] According to an embodiment of the present disclosure, when a traffic node receives a message request, it includes: when a message request is sent from the outside to the distributed system, if the distributed system forwards the request to the traffic node for processing after processing, the traffic node receives the message request.

[0014] The second aspect of the present disclosure provides a message desensitizing device for desensitizing messages received by each traffic node in a distributed system, wherein, for any traffic node in the distributed system, the device includes: a data caching module, for caching at least one desensitizing rule and a desensitizing algorithm, each desensitizing rule including an application name, a resource name, a preset desensitizing field and a preset desensitizing type, and each desensitizing algorithm corresponds to each preset desensitizing type; a message acquisition module, for acquiring the field to be desensitized and the type to be desensitized in the message request when the traffic node receives a message request, the field to be desensitized and the type to be desensitized being at least one of the preset desensitizing field and the preset desensitizing type respectively; and a field desensitizing module, for retrieving the number of occurrences and path of the field to be desensitized in the message request according to a preset retrieval method, and calling the desensitizing algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized.

[0015] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned message desensitization method.

[0016] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned message desensitization method.

[0017] The fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned message desensitization method when executed by a processor.

[0018] Compared with the prior art, the message desensitization method, device, electronic device, storage medium, and program product provided by the present disclosure have at least the following beneficial effects:

[0019] (1) This disclosure can accurately desensitize JSON strings. For complex JSON strings, it can also use a general method to desensitize specified fields.

[0020] (2) The present disclosure enables each traffic node in a distributed system to easily use cached data to improve resource utilization and system response performance.

[0021] (3) This disclosure is applicable to most current traffic recording frameworks, such as sandbox, embedded SDK, network card acquisition and recording, bytecode enhancement recording, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0023] Figure 1 The following schematically illustrates an application scenario of the message desensitization method and device according to an embodiment of the present disclosure;

[0024] Figure 2 The flowchart of the message desensitization method according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 3 The following schematically shows a flow chart of a preset search method according to an embodiment of the present disclosure;

[0026] Figure 4 The following schematically illustrates an operational flow chart of a message desensitization method according to an embodiment of the present disclosure;

[0027] Figure 5 The flowchart of the desensitization process and subsequent operations according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 6 Schematically shows a flow chart of distributed system processing according to an embodiment of the present disclosure;

[0029] Figure 7 The following schematically shows a structural block diagram of a message desensitization device according to an embodiment of the present disclosure;

[0030] Figure 8 A block diagram of an electronic device suitable for implementing the message desensitization method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0031] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0032] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0034] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0035] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0036] The embodiments of the present disclosure provide a message desensitization method, apparatus, equipment, storage medium and program product, which relate to the field of cloud computing technology, and specifically to the field of data desensitization technology. The method is used to desensitize messages received by each traffic node in a distributed system. For any traffic node in the distributed system, the method includes: caching at least one desensitization rule and desensitization algorithm, each desensitization rule includes an application name, a resource name, a preset desensitization field and a preset desensitization type, and each desensitization algorithm corresponds to each preset desensitization type; when the traffic node receives a message request, the field to be desensitized and the type to be desensitized in the message request are obtained, and the field to be desensitized and the type to be desensitized are respectively at least one of the preset desensitization field and the preset desensitization type; according to the preset retrieval method, the number of occurrences and the path of the field to be desensitized in the message request are retrieved, and the desensitization algorithm corresponding to the type to be desensitized is called to desensitize the field to be desensitized.

[0037] Figure 1 The following schematically illustrates an application scenario of the message desensitization method and device according to an embodiment of the present disclosure. Figure 1 The examples shown are merely examples of application scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0038] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0039] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0040] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0041] Server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal device.

[0042] It should be noted that the message desensitization method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the message desensitization device provided in the embodiment of the present disclosure can generally be set in the server 105. The message desensitization method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the message desensitization device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0044] The following will be based on Figure 1 The application scenario described by Figures 2 to 6 The message desensitization method of the disclosed embodiment is described in detail.

[0045] Figure 2 The flowchart of the message desensitization method according to an embodiment of the present disclosure is schematically shown.

[0046] like Figure 2As shown, the message desensitization of this embodiment is used to desensitize messages received by each traffic node in the distributed system, wherein, for any traffic node in the distributed system, the method may include operations S210 to S240.

[0047] In operation S210, at least one desensitization rule and desensitization algorithm are cached, each desensitization rule includes an application name, a resource name, a preset desensitization field, and a preset desensitization type, and each desensitization algorithm corresponds to each preset desensitization type.

[0048] This step pre-caches desensitization rules and desensitization algorithms in all traffic nodes of the distributed system. The desensitization rules and desensitization algorithms can be defined independently by the administrator so that when subsequent message requests are received, the server can automatically perform targeted message desensitization.

[0049] For example, a user enters the following desensitization rules on the server front desk:

[0050] F-TRRP+com.icbc.prrs.access.service.ATSRemitDetail__1_0#doQuery+school.teacher.name+preset desensitization type, where F-TRRP represents the application name, and com.icbc.prrs.access.service.ATSRemitDetail__1_0#doQuery represents the resource name under the application, also known as the access path. The resource name may include, but is not limited to, a web link address, a storage path for file data, and so on. school.teacher.name represents the preset desensitization field, which is mainly various parameters or data provided by the user, representing information such as school, teacher, and name. The preset desensitization type is user-defined. In addition, the desensitization algorithm corresponding to the preset desensitization type must also be defined.

[0051] In operation S220, when the traffic node receives a message request, it obtains the field to be desensitized and the type to be desensitized in the message request, where the field to be desensitized and the type to be desensitized are at least one of the preset desensitizing fields and the preset desensitizing types.

[0052] Since the distributed system has multiple traffic nodes, when a traffic node receives a message request from the traffic gateway, that is, when the traffic node receives a message request. Then, when the traffic node receives a message request, since the received message request does not necessarily cover all the preset desensitizing fields and preset desensitizing types pre-set in operation S210, the server needs to obtain the fields to be desensitized and the types to be desensitized corresponding to the message request from the cache according to the resource information reflected in the received message request. Therefore, the fields to be desensitized and the types to be desensitized are respectively at least one of the preset desensitizing fields and the preset desensitizing types, that is, the fields to be desensitized and the types to be desensitized are respectively part or all of the preset desensitizing fields and the preset desensitizing types.

[0053] In operation S230, the occurrence count and path of the field to be desensitized in the message request are retrieved according to a preset retrieval method, and a desensitization algorithm corresponding to the type to be desensitized is called to desensitize the field to be desensitized.

[0054] The preset retrieval method is pre-set, and for example, can also be cached in operation S210. After obtaining the to-be-desensitized field and the to-be-desensitized type of the corresponding message request, the server can retrieve the number of occurrences and paths of the to-be-desensitized field in the message request, so as to perform desensitization on all occurrences of the to-be-desensitized field. The desensitization algorithm needs to be selected according to the obtained to-be-desensitized type.

[0055] According to the embodiments of the present disclosure, when a traffic node in a distributed system receives a message request from a traffic gateway, the fields to be desensitized and the types to be desensitized corresponding to the message request are obtained according to the pre-cached desensitization rules. Then, based on the preset retrieval method, the number of occurrences and paths of the fields to be desensitized in the message request are found, and all the fields to be desensitized are desensitized, thereby ensuring the security and availability of the data. This message desensitization method is applicable to most current backend management servers and provides a universal way to desensitize specified fields.

[0056] In the embodiment of the present disclosure, the message request is a string in JSON format. Those skilled in the art know that JSON (JavaScript Object Notation) is a lightweight data exchange format that uses a text format that is completely independent of the programming language to store and represent data.

[0057] JSON has only two structures: objects and arrays. Arrays are represented by square brackets [ ], and objects are represented by curly brackets {}. Parameter name / value pairs form arrays and objects. Parameter names are enclosed in double quotes, and parameter values ​​can be strings, numbers, Booleans, null, objects, and arrays. Furthermore, parallel data is separated by commas (,). JSON strings therefore use nested and combined parameter name / value pairs to represent a wide variety of data. Its concise and clear hierarchical structure makes JSON an ideal data exchange language, easy for humans to read and write, as well as for machines to parse and generate, effectively improving network transmission efficiency.

[0058] For example, the message request can be a JSON format string as shown below:

[0059] {"school":[{"teacher":{"name":"yzr"},"test1":"test1"}],"UserPass":["1234567890"]}

[0060] The message request contains the three parameter names "school", "teacher", and "name" provided by the user, which are nested and combined from the outside to the inside. In addition, the parameter name "UserPass" is also set, and its parameter value corresponds to 1234567890.

[0061] Based on the data format of the above message request, Figure 3 The flowchart of the preset retrieval method according to an embodiment of the present disclosure is schematically shown.

[0062] like Figure 3 As shown, the preset search method in operation S230 may include operations S231 to S233.

[0063] In operation S231 , the field to be desensitized is segmented into a field array including a plurality of word segmentation fields using designated characters.

[0064] For example, in the preceding message request, the user-provided field to be desensitized is school.teacher.name. Based on the specified character (dot) (.), the field to be desensitized is split into the field array ["school","teacher","name"]. This field array includes three segmentation fields: school, teacher, and name.

[0065] In operation S232 , the JSON format string is converted into JSONObject type data.

[0066] For example, the message request in the above example is converted into JSONObject type data.

[0067] In operation S233, at least one word segmentation field in the field array is determined as a designated field, and the occurrence number and path of the designated field contained in the JSONObject type data are traversed and queried.

[0068] This step, for example, determines a word segmentation field name included in the field array of the above example as the designated field, and then traverses and queries the occurrence count and path of the field name contained in the JSONObject type data.

[0069] Through the embodiments of the present disclosure, universal data desensitization can be performed on message requests in any JSON format string, and precise desensitization can be performed based on specified fields.

[0070] In the embodiment of the present disclosure, searching the path of the field to be desensitized in the message request in operation S230 may include: traversing the shortest path from the outermost layer of the JSON format string to the innermost layer to the specified field.

[0071] For example, a JSON format string

[0072] The path of a specified field test1 in {"UserName":[{"test":null,"test1":"test1"}],"UserPass":["1234567890"]} is UserName.test1, and paths are separated by periods (.).

[0073] Figure 4 The following schematically shows an operational flow chart of the message desensitization method according to an embodiment of the present disclosure.

[0074] like Figure 4 As shown, optionally, the desensitization rules can be stored in the relational database management system MySQL, and the full-text search engine Elasticsearch is used to traverse and query the number of occurrences and paths of specified fields contained in the JSONObject type data.

[0075] MySQL is a relational database management system developed by MySQL AB of Sweden, now owned by Oracle. MySQL is a relational database management system, which stores data in separate tables rather than storing all data in a single, centralized repository, increasing speed and flexibility. Elasticsearch (ES) is a highly scalable, open-source, full-text search and analytics engine that can rapidly store, search, and analyze massive amounts of data in near real time.

[0076] In the embodiment of the present disclosure, the JSON format string includes a key-value pair consisting of a parameter name and a parameter value, and the designated field is at least one parameter name in the JSON format string.

[0077] Figure 5 The flowchart of the desensitization process and subsequent operations according to an embodiment of the present disclosure is schematically shown.

[0078] like Figure 5 As shown, in the embodiment of the present disclosure, the desensitization process and its subsequent operations may include operations S510 to S530.

[0079] In operation S510 , a desensitization algorithm corresponding to the type to be desensitized is called to desensitize the parameter value corresponding to the specified field in the JSON format string.

[0080] In operation S520, the corresponding parameter value in the JSON format string is replaced with the desensitized parameter value.

[0081] In operation S530 , the replaced JSON format string is converted into a JSON object.

[0082] Thus, the disclosed embodiment can traverse and query all parameter values ​​corresponding to the specified fields in the JSONObject type data and perform desensitization. For example, for the message request in the above example, the parameter value "yzr" corresponding to the parameter name "name" can be desensitized to ensure the security of the user input data. Then, the replaced JSON format string, that is, the desensitized data, will be copied or converted into the JSON object layer by layer.

[0083] In the embodiment of the present disclosure, the message desensitization method can be applied to a traffic recording platform, which can perform traffic recording through at least one of the following methods: sandbox, embedded SDK, network card acquisition recording, or bytecode enhancement recording.

[0084] Therefore, this message desensitization method can be applied to most current traffic recording platforms. As a background management server, the traffic recording platform needs to desensitize all types of data uploaded to the platform to ensure data security and availability.

[0085] Specifically, in the field of computer security, a sandbox is a mechanism for securely running programs, often used to execute untrusted programs. An embedded SDK is a collection of development tools used by software engineers to create application software for specific software packages, software frameworks, hardware platforms, operating systems, and so on. Network card recording or bytecode enhancement recording is suitable for most current traffic recording frameworks.

[0086] Figure 6 The flowchart of the distributed system processing according to the embodiment of the present disclosure is schematically shown.

[0087] like Figure 6 As shown, in the embodiment of the present disclosure, when a traffic node receives a message request, it may include operation S610, which may be set at Figure 2 Between operation S210 and operation S220 shown.

[0088] In operation S610, when an external message request is sent to the distributed system, if the distributed system forwards the request to the traffic node for processing after processing, the traffic node receives the message request.

[0089] Among the nodes in a distributed system, only the traffic node that receives a message request will receive and process it. Other traffic nodes that do not receive a message request do not receive the message request, meaning that there is no operation to process the message request. Other traffic nodes will only immediately receive and process the message request if there is another external request and the request is loaded onto other traffic nodes. Through the embodiments of the present disclosure, each traffic node in a distributed system can easily use cached data to improve resource utilization and system responsiveness.

[0090] Based on the above message desensitization method, the present disclosure also provides a message desensitization device. Figure 7 The device is described in detail.

[0091] Figure 7 The structural block diagram of the message desensitization device according to an embodiment of the present disclosure is schematically shown.

[0092] The message desensitization device of this embodiment is used to desensitize messages received by each traffic node in the distributed system, wherein, for any traffic node in the distributed system, such as Figure 7 As shown, the message desensitizing device 700 includes a data cache module 710 , a message acquisition module 720 and a field desensitizing module 730 .

[0093] The data caching module 710 is used to cache at least one desensitization rule and desensitization algorithm, where each desensitization rule includes an application name, a resource name, a preset desensitization field, and a preset desensitization type, and each desensitization algorithm corresponds to each preset desensitization type. In one embodiment, the data caching module 710 can be used to perform operation S210 described above, which will not be repeated here.

[0094] The message acquisition module 720 is configured to, when a traffic node receives a message request, obtain the to-be-demensitized field and the to-be-demensitized type in the message request, where the to-be-demensitized field and the to-be-demensitized type are at least one of a preset desensitized field and a preset desensitized type. In one embodiment, the message acquisition module 720 can be configured to perform operation S220 described above, which will not be further described herein.

[0095] Field desensitization module 730 is configured to retrieve the number of occurrences and paths of the to-be-desensitized field in the message request according to a preset search method, and to invoke a desensitization algorithm corresponding to the to-be-desensitized type to desensitize the to-be-desensitized field. In one embodiment, field desensitization module 730 can be configured to perform operation S230 described above, which will not be further described herein.

[0096] According to the embodiments of the present disclosure, when a traffic node in a distributed system receives a message request from a traffic gateway, the fields to be desensitized and the types to be desensitized corresponding to the message request are obtained according to the pre-cached desensitization rules. Then, based on the preset retrieval method, the number of occurrences and paths of the fields to be desensitized in the message request are found, and all the fields to be desensitized are desensitized, thereby ensuring the security and availability of the data. This message desensitization method is applicable to most current backend management servers and provides a universal way to desensitize specified fields.

[0097] According to embodiments of the present disclosure, any multiple modules among the data cache module 710, the message acquisition module 720, and the field masking module 730 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present disclosure, at least one of the data cache module 710, the message acquisition module 720, and the field masking module 730 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the data cache module 710, the message acquisition module 720, and the field masking module 730 can be at least partially implemented as a computer program module that, when executed, can perform the corresponding functionality.

[0098] Figure 8 A block diagram of an electronic device suitable for implementing the message desensitization method according to an embodiment of the present disclosure is schematically shown.

[0099] like Figure 8 As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage unit 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0100] Various programs and data required for the operation of the electronic device 800 are stored in the RAM 803. The processor 801, ROM 802, and RAM 803 are connected to each other via a bus 804. The processor 801 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than the ROM 802 and RAM 803. The processor 801 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0101] According to an embodiment of the present disclosure, electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to bus 804. Electronic device 800 may also include one or more of the following components connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 808 including a hard disk; and a communication section 809 including a network interface card such as a LAN card or modem. Communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. Removable media 811, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 810 as needed, so that computer programs read from the removable media can be installed into storage section 808 as needed.

[0102] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently without being incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the message desensitization method according to the embodiments of the present disclosure.

[0103] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above, and / or one or more memories other than ROM 802 and RAM 803.

[0104] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to enable the computer system to implement the message desensitization method provided by the embodiments of the present disclosure.

[0105] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0106] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0107] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from a removable medium 811. When the computer program is executed by the processor 801, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0108] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0109] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0111] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A message desensitization method for desensitizing messages received by each traffic node in a distributed system, characterized in that: For any traffic node in a distributed system, the method includes: Cache at least one desensitization rule and desensitization algorithm, each of the desensitization rules including an application name, a resource name, a preset desensitization field, and a preset desensitization type, and each of the desensitization algorithms corresponds to each of the preset desensitization types; When the traffic node receives a message request, obtaining a field to be desensitized and a type to be desensitized in the message request, where the field to be desensitized and the type to be desensitized are at least one of the preset desensitization field and the preset desensitization type respectively; and Retrieve the number of occurrences and path of the field to be desensitized in the message request according to a preset retrieval method, and call a desensitization algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized; The desensitized fields are various parameters or data provided by the user, the desensitized type is user-defined, the message request is a JSON format string, and the preset retrieval method includes: Split the to-be-massaged field into a field array including multiple word segmentation fields using specified characters; Convert the JSON format string into JSONObject type data; At least one word segmentation field in the field array is determined as a designated field, and the occurrence number and path of the designated field contained in the JSONObject type data are traversed and queried.

2. The method according to claim 1, wherein The retrieving a path of the field to be desensitized in the message request includes: The shortest path from the outermost layer of the JSON format string to the specified field is traversed layer by layer.

3. The method according to claim 1, wherein The desensitization rules are stored in the relational database management system MySQL, and the full-text search engine Elasticsearch is used to traverse and query the number of occurrences and paths of the specified fields contained in the JSONObject type data.

4. The method according to claim 1, wherein The JSON format string includes a key-value pair consisting of a parameter name and a parameter value, the designated field is at least one parameter name in the JSON format string, and the calling of a desensitization algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized includes: Call the desensitization algorithm corresponding to the type to be desensitized to desensitize the parameter value corresponding to the specified field in the JSON format string.

5. The method according to claim 1, wherein After the step of calling the desensitization algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized, the method further includes: Replace the corresponding parameter value in the JSON format string with the desensitized parameter value; Convert the replaced JSON format string into a JSON object.

6. The method according to claim 1, wherein The method is applied to a traffic recording platform, which records traffic in at least one of the following ways: Recording in sandbox, embedded SDK, network card, or bytecode enhancement mode.

7. The method according to claim 1, wherein When the traffic node receives a message request, the process includes: When a message request is sent from outside to the distributed system, if the distributed system processes the message request and then forwards the message request to the traffic node for processing, the traffic node receives the message request.

8. A message desensitizing device for desensitizing messages received by each traffic node in a distributed system, characterized in that: For any traffic node in a distributed system, the device includes: A data caching module, configured to cache at least one desensitization rule and a desensitization algorithm, each of the desensitization rules including an application name, a resource name, a preset desensitization field, and a preset desensitization type, and each of the desensitization algorithms corresponding to each of the preset desensitization types; a message acquisition module, configured to, when the traffic node receives a message request, acquire a field to be desensitized and a type to be desensitized in the message request, wherein the field to be desensitized and the type to be desensitized are respectively at least one of the preset desensitization field and the preset desensitization type; and A field desensitization module is used to retrieve the number of occurrences and paths of the field to be desensitized in the message request according to a preset retrieval method, and call a desensitization algorithm corresponding to the type to be desensitized to desensitize the field to be desensitized; The desensitized fields are various parameters or data provided by the user, the desensitized type is user-defined, the message is a JSON format string, and the preset retrieval method includes: Split the to-be-massaged field into a field array including multiple word segmentation fields using specified characters; Convert the JSON format string into JSONObject type data; At least one word segmentation field in the field array is determined as a designated field, and the occurrence number and path of the designated field contained in the JSONObject type data are traversed and queried.

9. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images