A request processing method and apparatus

Abstract

The present disclosure relates to a request processing method and device, which is applied to a DAL, wherein the DAL is a DAL connected with at least two business systems, and the DAL is pre-configured with a desensitization rule for each business system, and the DAL realizes the processing of a data access request through the following steps: after receiving the data access request, determining whether the data access request is an access request for sensitive data according to the identification of sensitive data in the desensitization rule configured for the business system sending the data access request; in the case of determining that the data access request is an access request for sensitive data, encrypting the data or data identifier contained in the data access request according to the encryption algorithm of each kind of sensitive data included in the desensitization rule, and sending the encrypted data access request to the database.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer application, and particularly relates to a request processing method and device. BACKGROUND

[0002] For any business system, the database of the service end thereof stores information of a user, and some information belongs to personal privacy (such as sensitive information) of the user. Currently, some business systems have stored personal privacy information in a manner of plaintext storage rather than ciphertext storage, and there is a risk of data leakage.

[0003] In order to prevent data leakage, it is necessary to convert the sensitive information stored in the database from plaintext storage to ciphertext storage. Since the business system needs to use plaintext data rather than ciphertext data, when the data is converted to ciphertext data, it is also necessary to modify the execution logic of the business system, that is, each read operation is modified to read first and then decrypt, and each write operation is modified to encrypt first and then write. The way of modifying the execution logic of the business system is relatively complex to implement and increases the workload. In particular, in the case where the database stores data of multiple business systems, it is necessary to configure the multiple business systems respectively, and the workload is large. SUMMARY

[0004] To overcome the problems in the related art, the present disclosure provides a request processing method and device.

[0005] According to a first aspect of an embodiment of the present disclosure, a request processing method is provided, applied to a data access layer (DAL) of a database, and sensitive data in the database is encrypted in advance; the database interfaces with at least two business systems, and for each business system interfaced with the database, the business system is configured with a desensitization rule of the business system on the DAL; the method comprises the following steps.

[0006] receiving a data access request sent by any business system, the data access request being a data read request or a data write request;

[0007] determining whether the data access request is an access request for sensitive data according to an identifier of sensitive data included in a reference desensitization rule, the reference desensitization rule being a desensitization rule configured by the business system sending the data access request;

[0008] in a case where it is determined that the data access request is an access request for sensitive data, rewriting the data access request according to an encryption algorithm of each kind of sensitive data included in the reference desensitization rule, and sending the rewritten data access request to the database.

[0009] According to a second aspect of the embodiments of the present disclosure, a request processing apparatus is provided, which is applied to a data access layer (DAL) of a database, and sensitive data in the database is encrypted in advance; the database interfaces with at least two business systems, and for each business system interfaced with the database, the business system is configured with a desensitization rule of the business system on the DAL; and the apparatus comprises:

[0010] an access request receiving module configured to receive a data access request sent by any business system, the data access request being a data read request or a data write request;

[0011] an access request judging module configured to judge whether the data access request is an access request for sensitive data according to an identifier of sensitive data included in a reference desensitization rule, the reference desensitization rule being a desensitization rule configured by the business system sending the data access request;

[0012] an access request rewriting module configured to rewrite the data access request according to an encryption algorithm of each kind of sensitive data included in the reference desensitization rule in a case where it is determined that the data access request is an access request for sensitive data, and send the rewritten data access request to the database.

[0013] According to a third aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, which stores a computer program, and the program is executed by a processor to implement the request processing method.

[0014] According to a fourth aspect of the embodiments of the present disclosure, a computer device is provided, which comprises:

[0015] one or more processors;

[0016] a memory configured to store one or more programs;

[0017] when the one or more programs are executed by the one or more processors, the one or more processors implement the request processing method.

[0018] The present disclosure relates to a request processing method and device, which is applied to a DAL, wherein the DAL is a DAL connected with at least two business systems, and the DAL is pre-configured with a desensitization rule for each business system, and the DAL realizes the processing of a data access request through the following steps: after receiving the data access request, determining whether the data access request is an access request for sensitive data according to the identification of sensitive data in the desensitization rule configured for the business system sending the data access request, and in the case that the data access request is an access request for sensitive data, encrypting the data or data identifier contained in the data access request according to the encryption algorithm of each kind of sensitive data included in the desensitization rule, and sending the encrypted data access request to the database.

[0019] In this way, by configuring the desensitization rules of multiple business systems on the DAL, and the DAL can encrypt the data access request according to the configured desensitization rules, so that the business system can realize the access operation for the encrypted data, and since it is realized on the DAL, code invasion is avoided, development cost is reduced, and the database is not burdened with a large processing load.

[0020] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings incorporated in the specification and constituting a part of the present disclosure illustrate embodiments consistent with the present disclosure and serve together with the specification to explain the principles of the present disclosure.

[0022] Figure 1 FIG. 1 is a flowchart of a request processing method according to an exemplary embodiment of the present disclosure.

[0023] Figure 2A FIG. 2 is an application scenario diagram of another request processing method according to an exemplary embodiment of the present disclosure.

[0024] Figure 2B FIG. 3 is an application scenario diagram of still another request processing method according to an exemplary embodiment of the present disclosure.

[0025] Figure 2C FIG. 4 is an application scenario diagram of yet another request processing method according to an exemplary embodiment of the present disclosure.

[0026] Figure 3 FIG. 5 is a structural diagram of a DAL according to a specific embodiment of the present disclosure.

[0027] Figure 4 FIG. 6 is a block diagram of a request processing device according to an exemplary embodiment of the present disclosure.

[0028] Figure 5 Fig. 1 is a hardware structure diagram of a computer device where a request processing apparatus according to an exemplary embodiment of the present disclosure is located. DETAILED DESCRIPTION

[0029] The exemplary embodiments will be described in detail below with reference to the attached drawings. The following description is made with reference to the accompanying drawings, in which like reference numerals refer to like elements, and redundant descriptions are omitted. The following exemplary embodiments described in the detailed description are illustrative of the embodiments consistent with the present disclosure and should not be construed as restrictive thereof. Rather, these exemplary embodiments are described solely for the purpose of illustrating aspects of the present disclosure as recited in the appended claims.

[0030] The terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used in the present disclosure and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0031] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used solely to distinguish one from another only. For example, a first information can be termed a second information, and similarly, a second information can also be termed a first information, without departing from the scope of the present disclosure. As used herein, the word "if' can be construed to mean "when" or "in response to determining" or "in response to a determination" depending on the context.

[0032] For a company, in order to facilitate storage, data of multiple business systems of the company are generally stored in one database. And when developing each business system, if no encryption logic is written for the business system, then if encryption of the stored data of the business system is needed later, the logic of the business system needs to be rewritten, which brings a large amount of work, especially in the case of a large number of business systems and data, the amount of work will be even larger.

[0033] To solve the above problems, considering that in the case where there are multiple business systems and each business system has a large variety of data, the method of realizing encryption by changing the execution logic of the business system (such as changing the code on the business system side) is relatively cumbersome and difficult to maintain; and if it is realized on the business system side, such as by adding an SDK in the APP of the business client, in the case where the number of business systems is large, a separate SDK needs to be developed for each business system, which is still a large workload; if it is realized in the database, such as changing the write instruction in the database to write plus encryption instruction and changing the read instruction to read plus decryption instruction, the database needs to perform encryption and decryption operations, which will bring a large processing burden to the database.

[0034] Therefore, in order to realize the desensitization task of sensitive data stored in the database without code intrusion (that is, changing the logic of the business system), reducing development cost and not bringing a large processing burden to the database, the present disclosure proposes a request processing method, for a database connected with at least two business systems, the DAL of the database is pre-configured with desensitization rules for each business system, and the DAL realizes the processing of the data access request by the following steps: after receiving the data access request, according to the identification of sensitive data in the desensitization rule configured for the business system sending the data access request, it is determined whether the data access request is an access request for sensitive data, in the case where it is determined that the data access request is an access request for sensitive data, according to the encryption algorithm of each kind of sensitive data included in the desensitization rule, the data or data identifier contained in the data access request is encrypted, and the encrypted data access request is sent to the database.

[0035] In this way, by configuring the desensitization rules of multiple business systems on the DAL, and the DAL can encrypt the data access request according to the configured desensitization rules, so that the business system can realize the access operation for encrypted data, and since it is realized on the DAL, code intrusion is avoided, development cost is reduced, and the database will not bring a large processing burden.

[0036] Next, the embodiments of the present disclosure will be described in detail.

[0037] The present disclosure provides a request processing method applied to a data access layer (DAL) of a database, which pre-encrypts sensitive data in the database; the database is connected with at least two business systems, and for each business system connected to the database, the business system is configured with a desensitization rule of the business system on the DAL.

[0038] First, the database involved in this disclosure will be explained. To ensure the security of sensitive data in the database, the sensitive data in the database is encrypted in advance. In addition, besides the sensitive data being encrypted, the identifiers used to identify sensitive data in the database are also encrypted to prevent the sensitive data from being targeted for decryption.

[0039] The encryption algorithm used to encrypt sensitive data is the same as the encryption algorithm specified in the desensitization rules. For example, if the data is identified as A and the encryption algorithm configured for that data in the desensitization rules is B, then algorithm B will be used to encrypt data A in the database.

[0040] This database connects to at least two business systems, each with its own data masking rules configured on the DAL. Specific configuration methods for these rules are detailed later and will not be elaborated upon here. Furthermore, the management device for the business systems refers to the device used to manage the backend of each business system.

[0041] like Figure 1 As shown, Figure 1 This is a flowchart illustrating a method according to an exemplary embodiment, comprising the following steps:

[0042] Step 101: Receive a data access request sent by any business system. The data access request may be a data read request or a data write request.

[0043] Specifically, before a data access request sent to the database reaches the database, it is received by the DAL. After receiving the request, the DAL processes it so that the database can execute the corresponding data access request and encrypt the data in the database.

[0044] The data access request may be sent by the client corresponding to the business system, the backend software of the business system, or the management device of the business system. This disclosure does not limit the source of the data access request.

[0045] Data access requests are generally either read or write requests. A read request typically includes an identifier for the data to be read and a read command. A write request typically includes the data to be written, an identifier for the data to be written (so the database knows where to store the data), and a write command. Additionally, a request to modify specific data can also be considered a write request.

[0046] Step 103, according to the identification of sensitive data included in the reference desensitization rule, it is judged whether the data access request is an access request for sensitive data, and the reference desensitization rule is the desensitization rule configured by the business system sending the data access request.

[0047] Specifically, since only sensitive data is encrypted in the method provided in the present disclosure, and read and write are implemented for encrypted sensitive data, other data will not be encrypted, so after the DAL receives the data, it needs to first determine whether the data access request is for sensitive data. If the data access request is not for sensitive data, the data access request can be directly sent to the database.

[0048] It should be noted that the desensitization rule generally includes the identification of data and the encryption algorithm used for each included data identification, so the data included in the data access request can be determined to be sensitive data according to the desensitization rule configured for the business system, and further processing of the access request is determined.

[0049] Step 105, in the case of determining that the data access request is an access request for sensitive data, rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference desensitization rule, and sending the rewritten data access request to the database.

[0050] Specifically, in the case of determining that the data accessed by the data access request is sensitive data, the data access request needs to be processed to enable the business system to access the encrypted database.

[0051] For data access requests, whether they are data read requests or data write requests, both types of requests contain the identification of the data to be accessed, and in the encrypted database, the identification of sensitive data is also encrypted (for example, for a key-value database, the key refers to the identification of the data). Therefore, the identification of the data included in the data access request needs to be encrypted so that the database can recognize the identification of the data to complete the reading or writing of the data. In some cases, the table name used by the database is different from the business system visible table name, in which case the identification of the data to be accessed by the data access request also needs to be changed so that the database can recognize the access request. In addition, for data write requests, the data to be written is generally included. In order to implement encryption of sensitive data in the database, the DAL also needs to encrypt the data included in the data write request.

[0052] In addition, in some cases, the identifier of the table seen by the database and the identifier of the table seen by the business system are different, such as tables A1 and A2 seen by the database, which are not visible to the business system, and only table A (the actual table A includes tables A1 and A2) is visible. In this case, the encrypted data access request also needs to be rewritten, that is, A is changed to A1, so that the database can identify the data access request.

[0053] The algorithm used to encrypt the data and the identifier of the data is the encryption algorithm of the sensitive data included in the de-sensitization rule configured by the business system from which the data access request comes. For example, for a certain data read request, the identifier of the data it targets is A, by looking up the de-sensitization rule of the business system, it is determined that the data with identifier A is encrypted by algorithm B, then the identifier A of the data included in the data read request is encrypted by algorithm B.

[0054] In addition, for a data read request, the data returned by the database is also encrypted data, in order for the business system to normally read the data in the database, in the case that the database returns data for the data read request, the returned data also needs to be decrypted.

[0055] In other words, in the case of a data access request being a data read request, rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule includes: in the case of the data access request being a data read request, determining the identifier of the data to be read by the data read request; rewriting the determined data identifier according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule. In addition, the method further comprises: in the case that the database returns data for the data read request, decrypting the returned data according to the encryption algorithm of each sensitive data included in the de-sensitization rule; returning the decrypted data to the business system.

[0056] In the case of a data access request being a data write request, rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule includes: in the case of the data access request being a data write request, determining the data to be written by the data write request and the identifier of the data; rewriting the determined data and the identifier of the data according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule.

[0057] After the description of how to encrypt the data and the identification of the data in step 105, it is necessary to describe how to encrypt. The algorithm for implementing encryption can be built into the DAL; in order to ensure the execution efficiency of the DAL, a separate encryption device can also be provided for encryption, which can be an external device attached to the DAL. Among them, considering that the de-sensitization rules are configured on the DAL, it is more efficient for the DAL to determine the encryption algorithm, so in the case of an encryption device, the DAL needs to determine the encryption algorithm corresponding to the data that needs to be encrypted or decrypted, and send the determined algorithm and the data that needs to be encrypted or decrypted to the encryption device together.

[0058] In other words, the encryption of the data or the identification of the data in the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule includes: determining the encryption algorithm of the data to which the data access request is directed according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule; sending the data included in the data access request and the encryption algorithm to the encryption device to encrypt the data or the identification of the data in the data access request; receiving the encrypted data access request returned by the encryption device, and rewriting the encrypted data access request if necessary.

[0059] Among them, the case that needs to be rewritten is also the case mentioned above that the identification of the database visible table and the identification of the business system visible table are different.

[0060] After describing the processing process of the data access request, the configuration method of the de-sensitization rule will be described below.

[0061] Since the database is connected to multiple different business systems, in order to facilitate, the present disclosure only provides a way to encrypt sensitive data, and does not pre-configure the de-sensitization rules in each system, but the technical personnel responsible for each business system configure the de-sensitization rules of each business system (the technical personnel of each business system knows the business system better, and knows which data is the business system). In order to enable the technical personnel to successfully configure the de-sensitization rules, a user manual for configuring the de-sensitization rules is provided for the technical personnel, and the technical personnel configures the de-sensitization rules according to the description of the de-sensitization rule configuration method on the user manual.

[0062] The configuration method of the de-sensitization rule will be described in detail below.

[0063] For different business systems, one data can be stored in each business system, that is, the data accessible by different business systems does not exist cross, in this case, since the data accessible by different business systems is different, the desensitization rule can be freely configured by each business system. The specific configuration can be that the technical personnel inputs the desensitization rule to be configured through the management device of the business system, or the DAL provides a plurality of pre-stored desensitization rules in advance, and the technical personnel selects one of the plurality of pre-stored desensitization rules for configuration.

[0064] In other words, the desensitization rule can be configured by the following method. A plurality of pre-stored desensitization rules are pre-configured, for each business system, the configuration process of the desensitization rule includes: determining the identifier of the data accessible by the business system, and obtaining the identifier of the sensitive data included in each pre-stored desensitization rule; determining the pre-stored desensitization rule whose included sensitive data identifier is all the identifier of the data accessible by the business system, taking the determined pre-stored desensitization rule as the pre-stored desensitization rule matched with the business system; pushing the pre-stored desensitization rule matched with the business system to the management device of the business system; obtaining the target desensitization rule selected by the user from the pushed pre-stored desensitization rule, and configuring the target desensitization rule.

[0065] In addition, in some cases, the same data can be used between different businesses, such as the same login account for business A and business B, in this case, in order to reduce the amount of stored data, the login account of business A and business B in the database is shared. In other words, the database contains shared data accessible by at least two business systems. In the case of shared data, the configured desensitization rule needs to ensure that the desensitization rules configured by different business systems for shared data are the same.

[0066] Next, how to realize that different business systems configure the same desensitization rule for shared data will be described.

[0067] First, in order to ensure that the shared data is configured with the same desensitization algorithm, a plurality of pre-stored desensitization rules (different pre-stored desensitization rules are configured with the same desensitization algorithm for shared data) can be pre-configured, and when each business system is configured, the business system is recommended several pre-stored desensitization rules, and the business system selects one of the pre-stored desensitization rules as the used desensitization rule. However, it needs to be ensured that the desensitization rules configured by different business systems for shared data are the same.

[0068] In other words, with pre-configured pre-stored de-identification rules, the configuration process for each business system includes: determining the pre-stored de-identification rules that match the business system, pushing the pre-stored de-identification rules that match the business system to the management device of the business system; obtaining the target de-identification rule selected by the user from the pushed pre-stored de-identification rules, and configuring the target de-identification rule.

[0069] Determining which pre-stored de-identification rule matches the business system can be done by using a pre-stored de-identification rule whose data identifiers in the pre-stored de-identification rule overlap with the data identifiers in the business system by more than a preset threshold as the matching de-identification rule.

[0070] Alternatively, the de-identification rules matching the business system can be determined in the following ways. Specifically, determining the identifiers of accessible data includes: identifying the identifiers of data accessible to the business system, and obtaining the identifiers of sensitive data included in each pre-stored de-identification rule; determining a pre-stored de-identification rule where all the identifiers of the included sensitive data are identifiers of data accessible to the business system, and using the determined pre-stored de-identification rule as the pre-stored de-identification rule matching the business system. The de-identification algorithms configured for shared data are the same across different pre-stored de-identification rules.

[0071] Alternatively, after determining the pre-stored desensitization rules that match the business system, a matching pre-stored desensitization rule can be randomly selected as the desensitization rule used by the business system.

[0072] Secondly, when shared data exists, the configuration method for de-identification rules can also be to pre-store only the de-identification rules for shared data, while the de-identification rules for non-shared data are configured by the user.

[0073] Specifically, pre-configured masking rules are provided for each piece of shared data. For each business system, the masking rule configuration process includes: determining the identifiers of the data that the business system can access; identifying the shared data among the data that the business system can access from the identifiers of the data that the business system can access; obtaining the pre-configured masking rules for the identified shared data, and obtaining the masking rules configured by the business system for other data besides the shared data; and using the obtained pre-configured masking rules and the masking rules configured by the business system as the masking rules configured by the business system.

[0074] Furthermore, to improve processing efficiency, the above methods can be implemented by scanning the configuration files of the business system when it goes live, and storing the identifiers of the data that the business system can access, obtained from the scan. Additionally, pre-stored data anonymization rules are pre-loaded during device startup to determine shared data.

[0075] In other words, the method further comprises: for each business system, in the case that the business system is online, obtaining a configuration result according to the configuration information of the business system; the configuration result at least comprises the identification of the data that the business system can access; pre-scanning to obtain the identification of the sensitive data included in each desensitization rule; and the determination of the identification of the data that the business system can access comprises: obtaining the configuration result for the business system, and determining the identification of the data that the business system can access.

[0076] Finally, in addition to the above-mentioned configuration method of the desensitization rule, all the desensitization rules can be configured by the user without pre-configuring the pre-stored desensitization rule. Before each configuration, the configured desensitization rules are scanned to prevent different business systems from configuring different desensitization rules for the same common data.

[0077] Specifically, for each business system, the configuration process of the desensitization rule comprises: determining the configured common data that has been configured with the desensitization rule from all the common data; in the case that the configured common data is included in the data that the business system can access, obtaining the desensitization rule configured by the business system for other data except the configured common data, and taking the obtained desensitization rule configured for the other data and the desensitization rule of the configured common data as the desensitization rule configured by the business system. In the case that the configured common data is not included in the data that the business system can access, obtaining the desensitization rule configured by the business system for all the accessible data, and taking the obtained desensitization rule as the desensitization rule configured by the business system.

[0078] After the configuration method of the desensitization rule is described, the desensitization of the online business will be described below.

[0079] For the online business, the above-mentioned method can be directly configured to complete the reading of the encrypted data. After the configuration is completed, the data reading and writing are performed according to the method shown in Figure 2A .

[0080] For the online business system, the data of the business system has been stored in the database. Therefore, for the online business system, there are three stages: in the first stage, the sensitive data stored in the database needs to be encrypted; sometimes the encryption result obtained by the encryption tool is not good, and there are still some unencrypted data. In this case, the DAL needs to wait for a period of time to complete the encryption of the unencrypted data. In order to ensure that the business system can normally read the data, the plaintext column and the ciphertext column are stored in the database for the sensitive data. The data reading request is performed on the plaintext column, and the data writing request is performed on the plaintext column and the ciphertext column. This waiting period is called the second stage, as shown in Figure 2BThe third stage, that is, after all the plaintext data is converted into ciphertext data, the plaintext data is deleted and only the ciphertext data is retained. The third stage can be seen from Figure 2C The specific access method of the ciphertext data is described above. It should be noted that Figure 2B and Figure 2C The logical column in the table refers to the identification of the column or table visible to the business system.

[0081] In other words, the business system connected to the database includes at least one online business system. In the second stage, for the online business system, the method further includes: sending the unencrypted data write request and the encrypted data write request to the database together. For the data read request, the above method is not applicable, and in the second stage, the data read request will not be encrypted and will directly read the plaintext data.

[0082] In addition, the structure of the DAL can be seen from Figure 3 The DAL desensitization framework enclosed by the dashed box is the newly added framework for implementing the request processing method of the present disclosure. For a new business system (that is, an unlined business system), only the desensitization rule needs to be configured to realize the encryption and access of sensitive data. For an old business system (that is, an online business system), the processing rule needs to be sent to the plaintext-to-ciphertext tool first, so that the plaintext data of the online business system already stored in the database can be converted into ciphertext. The processing rule refers to which data needs to be converted into ciphertext. In addition, the desensitization rule also needs to be sent to the DAL by the online business system to realize the rewriting of the data access request.

[0083] For the DAL, when the data access request (which can also be regarded as SQL) arrives, the SQL needs to be intercepted and parsed first. The desensitization interceptor will determine whether the current SQL needs to be rewritten according to the configured desensitization rule. In the case of determining that rewriting is needed, the SQL is sent to the encryption device for encryption, and the encrypted SQL is further rewritten. After the rewriting is completed, the database executes the rewritten SQL to obtain the data source.

[0084] Corresponding to the above-mentioned embodiments of the method, the present disclosure also provides embodiments of a device and a terminal to which the device is applied.

[0085] As shown in Figure 4 Figure 4 ​is a block diagram of a request processing apparatus according to an exemplary embodiment of the present disclosure, applied to a data access layer (DAL) of a database, sensitive data in the database being encrypted in advance; the database interfaces with at least two business systems, and for each business system interfaced with the database, the business system is configured with a desensitization rule of the business system on the DAL; the apparatus comprises:

[0086] An access request receiving module 410 is configured to receive a data access request sent by any business system, the data access request being a data read request or a data write request.

[0087] An access request judging module 420 is configured to judge whether the data access request is an access request for sensitive data according to an identifier of sensitive data included in a reference desensitization rule, the reference desensitization rule being a desensitization rule configured by the business system sending the data access request.

[0088] An access request rewriting module 430 is configured to rewrite the data access request according to an encryption algorithm of each kind of sensitive data included in the reference desensitization rule in a case where it is determined that the data access request is an access request for sensitive data, and send the rewritten data access request to the database.

[0089] The DAL is preconfigured with a plurality of pre-stored desensitization rules, and the apparatus further comprises a desensitization rule configuring module (not shown in the figure) configured to, for each business system, perform: determining an identifier of data accessible by the business system, and obtaining an identifier of sensitive data included in each pre-stored desensitization rule; determining a pre-stored desensitization rule whose included identifier of sensitive data is all the identifier of data accessible by the business system, taking the determined pre-stored desensitization rule as a pre-stored desensitization rule matched with the business system; pushing the pre-stored desensitization rule matched with the business system to a management apparatus of the business system; and obtaining a target desensitization rule selected by a user from the pushed pre-stored desensitization rules, and configuring the target desensitization rule.

[0090] In the above case, the database can contain common data accessible by at least two business systems, wherein the desensitization algorithms configured by different pre-stored desensitization rules for the common data are the same.

[0091] In the case that the database contains at least two common data accessible by business systems, the pre-configuration has pre-stored desensitization rules for each common data; the device further comprises a desensitization rule configuration module (not shown in the figure), which is specifically configured to: for each business system, perform: determining the identity of the data accessible by the business system; determining the common data in the data accessible by the business system from the identity of the data accessible by the business system; obtaining the pre-stored desensitization rules for the determined common data, and obtaining the desensitization rules configured by the business system for other data except the common data; and taking the obtained pre-stored desensitization rules and the desensitization rules configured by the business system as the desensitization rules configured by the business system.

[0092] In the above case, the device further comprises an obtaining module (not shown in the figure), which is specifically configured to: for each business system, in the case that the business system is online, obtaining a configuration result according to the configuration information of the business system; the configuration result at least includes the identity of the data accessible by the business system; and pre-scanning to obtain the identity of the sensitive data included in each desensitization rule; and the determination of the identity of the data accessible by the business system in the desensitization rule configuration module is specifically configured to: obtain the configuration result for the business system, and determine the identity of the data accessible by the business system.

[0093] In the case that the database contains at least two common data accessible by business systems, the device further comprises a desensitization rule configuration module (not shown in the figure), which is specifically configured to: for each business system, perform: determining the configured common data which has been configured with desensitization rules from all common data; in the case that the configured common data is included in the data accessible by the business system, obtaining the desensitization rules configured by the business system for other data except the configured common data, and taking the obtained desensitization rules configured for other data and the desensitization rules of the configured common data as the desensitization rules configured by the business system; and in the case that the configured common data is not included in the data accessible by the business system, obtaining the desensitization rules configured by the business system for all accessible data, and taking the obtained desensitization rules as the desensitization rules configured by the business system.

[0094] The DAL is externally connected with an encryption device; the access request rewriting module 430 is specifically configured: in the case where it is determined that the data access request is an access request for sensitive data, determining the encryption algorithm of the data to which the data access request is directed according to the encryption algorithm of each kind of sensitive data included in the reference desensitization rule; sending the data included in the data access request and the encryption algorithm to the externally connected encryption device to encrypt the data or the identifier of the data in the data access request; receiving the encrypted data access request returned by the encryption device, rewriting the encrypted data access request if rewriting is needed, and sending the rewritten data access request to the database.

[0095] The access request rewriting module 430 is specifically configured: in the case where it is determined that the data access request is an access request for sensitive data, and in the case where the data access request is a data reading request, determining the identifier of the data to be read by the data reading request, rewriting the determined data identifier according to the encryption algorithm of each kind of sensitive data included in the reference desensitization rule, and sending the rewritten data access request to the database. The device further includes a decryption module (not shown in the figure) that is specifically configured: in the case where the returned data of the database for the data reading request is received, decrypting the returned data according to the encryption algorithm of each kind of sensitive data included in the desensitization rule; returning the decrypted data to the business system.

[0096] The access request rewriting module 430 is specifically configured: in the case where it is determined that the data access request is an access request for sensitive data, and in the case where the data access request is a data writing request, determining the data to be written by the data writing request and the identifier of the data; rewriting the determined data and the identifier of the data according to the encryption algorithm of each kind of sensitive data included in the reference desensitization rule, and sending the rewritten data access request to the database.

[0097] The database interfaces with the business system, which includes at least one online business system; for the online business system, the device further includes a sending module (not shown in the figure) that is configured: sending the unrewritten data access request and the rewritten data access request together to the database.

[0098] The implementation processes of the functions and roles of the modules in the above device are specifically described in the implementation processes of the corresponding steps in the above method, which will not be repeated here.

[0099] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be seen from the part of the method embodiment. The device embodiment described above is only illustrative, wherein the modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, i.e., can be located in one place or distributed on multiple network modules. Part or all of the modules can be selected to achieve the purpose of the present disclosure according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0100] As Figure 5 shown, Figure 5 A hardware structure diagram of a computer device where the embodiment request processing device is located is shown, which can include one or more processors 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication connection within the device. The memory is used to store one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned request processing method. It should be noted that the plurality of processors in the one or more processors means at least two.

[0101] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit, central processor), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present disclosure.

[0102] The memory 1020 can be implemented in the form of a ROM (Read Only Memory, read-only memory), a RAM (Random Access Memory, random access memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present disclosure are implemented by software or firmware, the related program codes are stored in the memory 1020 and executed by the processor 1010.

[0103] The input / output interface 1030 is configured to connect an input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0104] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as a USB, a network cable, etc.) or a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.).

[0105] The bus 1050 includes a channel to transmit information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0106] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain components necessary for implementing the embodiments of the present disclosure, and does not necessarily contain all the components shown in the figure.

[0107] The embodiments of the present disclosure also provide a computer readable storage medium having a computer program stored thereon, which is executed by a processor to implement the above request processing method.

[0108] The computer readable medium includes permanent and non-permanent, removable and non-removable media, which can be realized by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition in this paper, the computer readable medium does not include transitory computer readable media such as modulated data signals and carriers.

[0109] The above describes particular embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, acts or steps recited in the claims can be performed in a different order and still accomplish the desired results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0110] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following, in general, the principles of the present disclosure and including such

[0111] It should be understood that the present disclosure is not limited to the precise structures as herein described and illustrated in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the present disclosure. The scope of the present disclosure is limited only by the claims that follow.

[0112] The above descriptions are only the preferred embodiment of the present disclosure, not intended to limit the present disclosure, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A request processing method characterized by comprising: A data access layer (DAL) applied to a database is used to encrypt sensitive data in the database in advance. The database interfaces with at least two business systems, and for each business system interfaced with the database, the business system is configured with a desensitization rule of the business system on the DAL. When the database contains common data accessible by at least two business systems, the desensitization rules configured by different business systems for the common data are the same. The method comprises: receiving a data access request sent by any business system, the data access request being a data read request or a data write request; the data carried in the data access request being plaintext data, the data carried in the data read request including an identifier of data to be accessed, and the data carried in the data write request including data to be written; determining whether the data access request is an access request for sensitive data according to an identifier of sensitive data included in a reference desensitization rule, the reference desensitization rule being a desensitization rule configured by the business system sending the data access request; in a case where it is determined that the data access request is an access request for sensitive data, rewriting the data access request according to an encryption algorithm of each kind of sensitive data included in the reference desensitization rule, and sending the rewritten data access request to the database.

2. The method of claim 1, wherein, a plurality of pre-stored desensitization rules are pre-configured, and for each business system, the configuration process of the desensitization rule comprises: determining an identifier of data accessible by the business system, and obtaining an identifier of sensitive data included in each pre-stored desensitization rule; determining a pre-stored desensitization rule in which all the included identifiers of sensitive data are the identifiers of data accessible by the business system, and taking the determined pre-stored desensitization rule as a pre-stored desensitization rule matched with the business system; pushing the pre-stored desensitization rule matched with the business system to a management device of the business system; and obtaining a target desensitization rule selected by a user from the pushed pre-stored desensitization rules, and configuring the target desensitization rule.

3. The method of claim 2, wherein, When the database contains common data accessible by at least two business systems, the desensitization algorithms configured by different pre-stored desensitization rules for the common data are the same.

4. The method of claim 1, wherein, The database contains common data accessible by at least two business systems, and pre-stored desensitization rules for each common data are pre-configured. For each business system, the configuration process of the desensitization rule comprises: determining an identifier of data accessible by the business system; from the identifier of data accessible by the business system, determining common data in the data accessible by the business system, obtaining a pre-stored desensitization rule for the determined common data, and obtaining a desensitization rule configured by the business system for other data except the common data; taking the obtained pre-stored desensitization rule and the desensitization rule configured by the business system as the desensitization rule configured by the business system.

5. The method according to any one of claims 2-4, characterized in that, The method further comprises: for each business system, obtaining a configuration result according to configuration information of the business system in a case where the business system is online; the configuration result at least includes an identifier of data accessible by the business system; and pre-scanning to obtain an identifier of sensitive data included in each desensitization rule. The determining the identity of the data accessible by the business system comprises: Obtaining a configuration result for the business system, and determining the identity of the data accessible by the business system.

6. The method of claim 1, wherein, When the database contains at least two common data accessible by business systems, for each business system, the configuration process of the de-sensitization rule comprises: Determining configured common data from all common data that has been configured with a de-sensitization rule; In the case that the configured common data is included in the data accessible by the business system, obtaining the de-sensitization rule configured by the business system for other data except the configured common data, and taking the obtained de-sensitization rule configured for other data and the de-sensitization rule of the configured common data as the de-sensitization rule configured by the business system. In the case that the configured common data is not included in the data accessible by the business system, obtaining the de-sensitization rule configured by the business system for all accessible data, and taking the obtained de-sensitization rule as the de-sensitization rule configured by the business system.

7. The method of claim 1, wherein, The rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule comprises: Determining the encryption algorithm of the data to which the data access request is directed according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule; Sending the data and the encryption algorithm included in the data access request to the encryption device to encrypt the data or the identity of the data in the data access request; Receiving the encrypted data access request returned by the encryption device, and rewriting the encrypted data access request if necessary.

8. The method of claim 1, wherein, The rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule comprises: In the case that the data access request is a data read request, determining the identity of the data required to be read by the data read request; Rewriting the determined data identity according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule. The method further comprises: In the case that the returned data of the database for the data read request is received, decrypting the returned data according to the encryption algorithm of each sensitive data included in the de-sensitization rule; Returning the decrypted data to the business system.

9. The method of claim 1, wherein, The rewriting the data access request according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule comprises: In the case that the data access request is a data write request, determining the data and the identity of the data required to be written by the data write request; Rewriting the determined data and the identity of the data according to the encryption algorithm of each sensitive data included in the reference de-sensitization rule.

10. The method of claim 1, wherein, The business system connected by the database comprises at least one online business system; For the online business system, the method further comprises: Sending the un-rewritten data access request and the rewritten data access request to the database together.

11. A request processing apparatus characterized by comprising: A data access layer (DAL) applied to a database is used to encrypt sensitive data in the database in advance; the database interfaces with at least two business systems, and for each business system interfaced with the database, the business system is configured with desensitization rules of the business system on the DAL; when the database contains common data accessible by at least two business systems, the desensitization rules configured by different business systems for the common data are the same; The apparatus comprises: An access request receiving module configured to receive a data access request sent by any business system, the data access request being a data read request or a data write request; the data carried in the data access request being plaintext data, the data carried in the data read request including an identifier of data to be accessed, and the data carried in the data write request including data to be written; An access request judging module configured to judge whether the data access request is an access request for sensitive data according to an identifier of sensitive data included in a reference desensitization rule, the reference desensitization rule being a desensitization rule configured by the business system sending the data access request; An access request rewriting module configured to rewrite the data access request according to an encryption algorithm of each kind of sensitive data included in the reference desensitization rule and send the rewritten data access request to the database when it is determined that the data access request is an access request for sensitive data.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the program is executed by the processor to implement the request processing method in any one of claims 1 to 10.

13. A computer device, comprising: The computer device comprises: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the request processing method in any one of claims 1 to 10.

Images